Malware Analysis Report

2025-06-16 07:07

Sample ID 240602-bd3lnsdc9t
Target 188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe
SHA256 4f31c30e3d09a7bd13a9a7e87438e1221a6dfdf1437df0b8f6657bf70f0f23e8
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f31c30e3d09a7bd13a9a7e87438e1221a6dfdf1437df0b8f6657bf70f0f23e8

Threat Level: Known bad

The file 188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Executes dropped EXE

Loads dropped DLL

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 01:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 01:02

Reported

2024-06-02 01:05

Platform

win7-20240508-en

Max time kernel

130s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\DVD Maker\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Internet Explorer\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\gl\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Chess\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\AppPatch\Custom\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\da\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\bn_IN\System Restore.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\gd\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC_32\mscorlib\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\update.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\update.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\update.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\System Restore.exe C:\Program Files (x86)\backup.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe N/A N/A
File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe C:\Program Files\DVD Maker\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\backup.exe C:\Program Files\VideoLAN\VLC\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe N/A N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe C:\Program Files\VideoLAN\VLC\locale\de\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe C:\Program Files\Microsoft Games\Purble Place\backup.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe C:\Program Files\Reference Assemblies\Microsoft\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\es-ES\data.exe C:\Program Files\Microsoft Games\Hearts\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe N/A
File opened for modification C:\Program Files\Windows Defender\fr-FR\backup.exe N/A N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\update.exe C:\Program Files\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\backup.exe C:\Program Files (x86)\backup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Globalization\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\inf\it-IT\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehiProxy\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\data.exe N/A N/A
File opened for modification C:\Windows\Boot\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\1033\backup.exe N/A N/A
File opened for modification C:\Windows\PLA\System Restore.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe N/A
File opened for modification C:\Windows\Help\Windows\de-DE\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\AspNetMMCExt\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\data.exe N/A N/A
File opened for modification C:\Windows\Media\Garden\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\backup.exe N/A N/A
File opened for modification C:\Windows\IME\IMESC5\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\inf\de-DE\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\tmp\backup.exe C:\Windows\assembly\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\System Restore.exe N/A N/A
File opened for modification C:\Windows\inf\MSDTC\040C\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\22965e871d3352b6ac09f8907be6a8cf\data.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\update.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\Help\Windows\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcGlidHostObj\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\1036\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\dc34242bf840d340e94d2657c7c33371\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\es\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\Help\mui\040C\backup.exe N/A N/A
File opened for modification C:\Windows\IME\IMESC5\DICTS\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\backup.exe N/A N/A
File opened for modification C:\Windows\ehome\MCX\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe N/A N/A
File opened for modification C:\Windows\IME\imekr8\backup.exe N/A N/A
File opened for modification C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\backup.exe N/A N/A
File opened for modification C:\Windows\inf\aspnet_state\001F\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\System Restore.exe N/A N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe
PID 2176 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe
PID 2176 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe
PID 2176 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe
PID 2176 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2176 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2176 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2176 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2176 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2176 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2176 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2176 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2176 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2176 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2176 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2176 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2176 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2176 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe
PID 2176 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe
PID 2176 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe
PID 2176 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe
PID 2548 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2548 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2548 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2548 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2176 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe
PID 2176 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe
PID 2176 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe
PID 2176 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe
PID 2364 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2364 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2364 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2364 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 1196 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe C:\backup.exe
PID 1196 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe C:\backup.exe
PID 1196 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe C:\backup.exe
PID 1196 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe C:\backup.exe
PID 1028 wrote to memory of 1940 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1028 wrote to memory of 1940 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1028 wrote to memory of 1940 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1028 wrote to memory of 1940 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1940 wrote to memory of 476 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1940 wrote to memory of 476 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1940 wrote to memory of 476 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1940 wrote to memory of 476 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1028 wrote to memory of 1612 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1028 wrote to memory of 1612 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1028 wrote to memory of 1612 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1028 wrote to memory of 1612 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1612 wrote to memory of 304 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1612 wrote to memory of 304 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1612 wrote to memory of 304 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1612 wrote to memory of 304 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Public\Music\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\Update\Download\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC_32\MSBuild\System Restore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe

C:\Users\Admin\AppData\Local\Temp\2253362136\backup.exe C:\Users\Admin\AppData\Local\Temp\2253362136\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\

C:\backup.exe

\backup.exe \

C:\PerfLogs\backup.exe

C:\PerfLogs\backup.exe C:\PerfLogs\

C:\PerfLogs\Admin\backup.exe

C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Program Files\Common Files\Microsoft Shared\data.exe

"C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\

C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\

C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\

C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\

C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\

C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\

C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\update.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\

C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\

C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe

"C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files\Common Files\SpeechEngines\backup.exe

"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe

"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\

C:\Program Files\Common Files\System\backup.exe

"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\

C:\Program Files\Common Files\System\ado\backup.exe

"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\System\ado\fr-FR\update.exe

"C:\Program Files\Common Files\System\ado\fr-FR\update.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\System\ado\ja-JP\update.exe

"C:\Program Files\Common Files\System\ado\ja-JP\update.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files\Common Files\System\fr-FR\backup.exe

"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\System\it-IT\backup.exe

"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\System\ja-JP\System Restore.exe

"C:\Program Files\Common Files\System\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files\Common Files\System\msadc\System Restore.exe

"C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files\Common Files\System\msadc\it-IT\System Restore.exe

"C:\Program Files\Common Files\System\msadc\it-IT\System Restore.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\Common Files\System\Ole DB\backup.exe

"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Program Files\Common Files\System\Ole DB\it-IT\System Restore.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files\Common Files\System\Ole DB\ja-JP\data.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\data.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Program Files\DVD Maker\backup.exe

"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\

C:\Program Files\DVD Maker\de-DE\backup.exe

"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\

C:\Program Files\DVD Maker\en-US\backup.exe

"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\

C:\Program Files\DVD Maker\es-ES\backup.exe

"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\

C:\Program Files\DVD Maker\fr-FR\backup.exe

"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\

C:\Program Files\DVD Maker\it-IT\backup.exe

"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\

C:\Program Files\DVD Maker\ja-JP\update.exe

"C:\Program Files\DVD Maker\ja-JP\update.exe" C:\Program Files\DVD Maker\ja-JP\

C:\Program Files\DVD Maker\Shared\backup.exe

"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\

C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\

C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\

C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\

C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\

C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\

C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\System Restore.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\

C:\Program Files\Google\backup.exe

"C:\Program Files\Google\backup.exe" C:\Program Files\Google\

C:\Program Files\Google\Chrome\backup.exe

"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\

C:\Program Files\Google\Chrome\Application\System Restore.exe

"C:\Program Files\Google\Chrome\Application\System Restore.exe" C:\Program Files\Google\Chrome\Application\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\System Restore.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Program Files\Internet Explorer\backup.exe

"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\

C:\Program Files\Internet Explorer\de-DE\backup.exe

"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Program Files\Internet Explorer\en-US\update.exe

"C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Program Files\Internet Explorer\fr-FR\backup.exe

"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files\Internet Explorer\images\System Restore.exe

"C:\Program Files\Internet Explorer\images\System Restore.exe" C:\Program Files\Internet Explorer\images\

C:\Program Files\Internet Explorer\it-IT\backup.exe

"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Program Files\Internet Explorer\ja-JP\backup.exe

"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files\Java\jdk1.7.0_80\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\

C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\db\

C:\Program Files\Java\jdk1.7.0_80\db\bin\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\db\bin\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\

C:\Program Files\Java\jdk1.7.0_80\include\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\

C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\update.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\update.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\data.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\data.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\

C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\

C:\Program Files (x86)\backup.exe

"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\

C:\Program Files (x86)\Common Files\DESIGNER\backup.exe

"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\

C:\Program Files\Java\jre7\backup.exe

"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\

C:\Program Files\Java\jre7\bin\backup.exe

"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\

C:\Program Files\Java\jre7\bin\dtplugin\data.exe

"C:\Program Files\Java\jre7\bin\dtplugin\data.exe" C:\Program Files\Java\jre7\bin\dtplugin\

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\

C:\Program Files\Java\jre7\bin\plugin2\backup.exe

"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\

C:\Program Files\Java\jre7\bin\server\backup.exe

"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\

C:\Program Files\Java\jre7\lib\backup.exe

"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\

C:\Program Files\Java\jre7\lib\amd64\backup.exe

"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\

C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Java\jre7\lib\applet\backup.exe

"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Java\jre7\lib\cmm\backup.exe

"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Java\jre7\lib\deploy\backup.exe

"C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files\Java\jre7\lib\ext\backup.exe

"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files\Java\jre7\lib\fonts\backup.exe

"C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\

C:\Program Files\Java\jre7\lib\images\backup.exe

"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe

"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files\Java\jre7\lib\jfr\System Restore.exe

"C:\Program Files\Java\jre7\lib\jfr\System Restore.exe" C:\Program Files\Java\jre7\lib\jfr\

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\

C:\Program Files\Java\jre7\lib\management\backup.exe

"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\

C:\Program Files\Java\jre7\lib\security\backup.exe

"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\

C:\Program Files\Java\jre7\lib\zi\backup.exe

"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\

C:\Program Files\Java\jre7\lib\zi\America\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\

C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\

C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\

C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\

C:\Program Files\Microsoft Games\backup.exe

"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\

C:\Program Files\Microsoft Games\Chess\backup.exe

"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\

C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\

C:\Program Files\Microsoft Games\Chess\en-US\backup.exe

"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\

C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\

C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\

C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\

C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\

C:\Program Files\Microsoft Games\FreeCell\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\

C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\

C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\

C:\Program Files\Microsoft Games\FreeCell\it-IT\System Restore.exe

"C:\Program Files\Microsoft Games\FreeCell\it-IT\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\

C:\Program Files\Microsoft Games\Hearts\backup.exe

"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe

"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\

C:\Program Files\Microsoft Games\Hearts\es-ES\data.exe

"C:\Program Files\Microsoft Games\Hearts\es-ES\data.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\

C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\

C:\Program Files\Microsoft Games\Mahjong\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\

C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\

C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\

C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\

C:\Program Files\Microsoft Games\Mahjong\fr-FR\update.exe

"C:\Program Files\Microsoft Games\Mahjong\fr-FR\update.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\

C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\

C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\

C:\Program Files\Microsoft Games\Minesweeper\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\

C:\Program Files\Microsoft Games\More Games\backup.exe

"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe

"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\

C:\Program Files\Microsoft Games\More Games\en-US\backup.exe

"C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe

"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\

C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe

"C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\

C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\

C:\Program Files\Microsoft Games\Multiplayer\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\System Restore.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\

C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\

C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\update.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\

C:\Program Files\Microsoft Games\Purble Place\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\

C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\

C:\Program Files\Microsoft Games\Purble Place\en-US\data.exe

"C:\Program Files\Microsoft Games\Purble Place\en-US\data.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\

C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\

C:\Program Files\Microsoft Games\Purble Place\it-IT\update.exe

"C:\Program Files\Microsoft Games\Purble Place\it-IT\update.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\

C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\

C:\Program Files\Microsoft Games\Solitaire\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\

C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\

C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\

C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\

C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\

C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\

C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\

C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\data.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\data.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\update.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\update.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\

C:\Program Files\Microsoft Office\Office14\backup.exe

"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\

C:\Program Files\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\

C:\Program Files\Mozilla Firefox\backup.exe

"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\

C:\Program Files\Mozilla Firefox\browser\backup.exe

"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\

C:\Program Files\Mozilla Firefox\defaults\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\

C:\Program Files\Mozilla Firefox\fonts\backup.exe

"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\update.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\update.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\

C:\Program Files\Mozilla Firefox\uninstall\backup.exe

"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\

C:\Program Files\MSBuild\Microsoft\backup.exe

"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Users\Admin\Contacts\backup.exe

C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Users\Admin\Documents\backup.exe

C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Users\Admin\Downloads\data.exe

C:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\

C:\Users\Admin\Links\backup.exe

C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Users\Admin\Saved Games\backup.exe

"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\

C:\Users\Admin\Videos\backup.exe

C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\

C:\Users\Public\backup.exe

C:\Users\Public\backup.exe C:\Users\Public\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\

C:\Users\Public\Documents\backup.exe

C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\

C:\Users\Public\Downloads\backup.exe

C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Users\Public\Music\backup.exe

C:\Users\Public\Music\backup.exe C:\Users\Public\Music\

C:\Program Files (x86)\Common Files\Services\backup.exe

"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\

C:\Users\Public\Music\Sample Music\backup.exe

"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe" C:\Program Files (x86)\Common Files\SpeechEngines\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Users\Public\Pictures\data.exe

C:\Users\Public\Pictures\data.exe C:\Users\Public\Pictures\

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Program Files (x86)\Common Files\System\backup.exe

"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\

C:\Users\Public\Pictures\Sample Pictures\backup.exe

"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Users\Public\Recorded TV\System Restore.exe

"C:\Users\Public\Recorded TV\System Restore.exe" C:\Users\Public\Recorded TV\

C:\Program Files (x86)\Common Files\System\ado\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Program Files\VideoLAN\VLC\backup.exe

"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\

C:\Users\Public\Recorded TV\Sample Media\backup.exe

"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files\VideoLAN\VLC\locale\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\

C:\Users\Public\Videos\Sample Videos\backup.exe

"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\

C:\Windows\backup.exe

C:\Windows\backup.exe C:\Windows\

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\data.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\data.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Windows\addins\backup.exe

C:\Windows\addins\backup.exe C:\Windows\addins\

C:\Program Files\VideoLAN\VLC\locale\af\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Windows\AppCompat\backup.exe

C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\

C:\Windows\AppPatch\backup.exe

C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Windows\AppPatch\AppPatch64\backup.exe

C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\

C:\Program Files (x86)\Common Files\System\de-DE\System Restore.exe

"C:\Program Files (x86)\Common Files\System\de-DE\System Restore.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Windows\AppPatch\Custom\data.exe

C:\Windows\AppPatch\Custom\data.exe C:\Windows\AppPatch\Custom\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Windows\AppPatch\Custom\Custom64\backup.exe

C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Windows\AppPatch\de-DE\backup.exe

C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\

C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Windows\AppPatch\en-US\backup.exe

C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\

C:\Windows\AppPatch\es-ES\backup.exe

C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\

C:\Program Files (x86)\Common Files\System\msadc\update.exe

"C:\Program Files (x86)\Common Files\System\msadc\update.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\

C:\Windows\AppPatch\fr-FR\backup.exe

C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Windows\AppPatch\it-IT\backup.exe

C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ar\

C:\Windows\AppPatch\ja-JP\backup.exe

C:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\

C:\Program Files (x86)\Google\CrashReports\backup.exe

"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Windows\assembly\GAC\ADODB\update.exe

C:\Windows\assembly\GAC\ADODB\update.exe C:\Windows\assembly\GAC\ADODB\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\

C:\Program Files (x86)\Google\Temp\backup.exe

"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\

C:\Program Files (x86)\Google\Update\backup.exe

"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\

C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Google\Update\Download\backup.exe

"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Program Files\VideoLAN\VLC\locale\be\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\data.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\data.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Program Files (x86)\Google\Update\Install\backup.exe

"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\

C:\Windows\assembly\GAC\Microsoft.mshtml\data.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\data.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\de-DE\System Restore.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\System Restore.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe

"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Windows\assembly\GAC\mscomctl\backup.exe

C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Windows\assembly\GAC\MSDATASRC\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\

C:\Windows\assembly\GAC\stdole\backup.exe

C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Analysis Services\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\

C:\Windows\assembly\GAC_32\backup.exe

C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\

C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\System Restore.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\

C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\

C:\Program Files\VideoLAN\VLC\locale\ca@valencia\update.exe

"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\update.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\data.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\

C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files (x86)\Microsoft Office\backup.exe

"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\CLIPART\data.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\data.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\

C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\

C:\Windows\assembly\GAC_32\ehexthost32\backup.exe

C:\Windows\assembly\GAC_32\ehexthost32\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\data.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\data.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\co\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\

C:\Program Files\VideoLAN\VLC\locale\da\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\de\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\

C:\Program Files\VideoLAN\VLC\locale\el\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\System Restore.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\

C:\Windows\assembly\GAC_32\Microsoft.Ink\update.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\update.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\

C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\Office14\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\

C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eo\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\

C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\

C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\es\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\update.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\

C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\

C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\et\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\

C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\

C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\

C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\

C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\

C:\Windows\assembly\GAC_32\MSBuild\System Restore.exe

"C:\Windows\assembly\GAC_32\MSBuild\System Restore.exe" C:\Windows\assembly\GAC_32\MSBuild\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\update.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\

C:\Windows\assembly\GAC_32\mscorlib\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\

C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\

C:\Windows\assembly\GAC_32\napcrypt\backup.exe

C:\Windows\assembly\GAC_32\napcrypt\backup.exe C:\Windows\assembly\GAC_32\napcrypt\

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\

C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\

C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\

C:\Windows\assembly\GAC_32\naphlpr\backup.exe

C:\Windows\assembly\GAC_32\naphlpr\backup.exe C:\Windows\assembly\GAC_32\naphlpr\

C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\

C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\

C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\3082\

C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\data.exe

C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\

C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\gd\update.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\update.exe" C:\Program Files\VideoLAN\VLC\locale\gd\

C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\

C:\Program Files\VideoLAN\VLC\locale\gl\update.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\update.exe" C:\Program Files\VideoLAN\VLC\locale\gl\

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\

C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\

C:\Program Files\VideoLAN\VLC\locale\he\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\

C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\2253362136\backup.exe

MD5 8de95fc5e3b18c50531f72e910cc1c7c
SHA1 0aa66b3f86696f5bacf0caca1d40a25191825422
SHA256 06e38395a2b583f89aa95639e55577218fd3a8fc67903bc636bab42fefdf8c53
SHA512 bab7cdfcf8c15ad348fe110fa9aba6847bd6ee4ef615ffe4bce370f76cf5cc5671cbcb3d0aed276392cc8e578cc17e4c692e5c57a172eb4c7af70196b784f6d7

\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe

MD5 11b05770172dbcf29727a677ef75dab1
SHA1 88ecb475d822ed55821a3985e7700adc478c8af1
SHA256 9ad454930549129feee9ced484e7a7d94091c0b4ecab50d571380eda6a38b87e
SHA512 8dade0752ee388c171af20470b8ba94471d5c5b9153a83f3528f2767888858cc541146fea1f4436489500a44e977116949b6a7f16481b14d075fed23a566d9a5

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 81d257ba07db61167a93dd50b449723c
SHA1 5af1b0ae46e9c4a505392a26bd8335509a04481a
SHA256 ed108fb7af01e4922d77b26c80bb333f11043c26526b2fafa0e12d5d0a4c2ff2
SHA512 3eb81b8fffd461777d3fe93ab44d111a001ede5374790d43622b923472c3229f3e35ae20df6000060b2e18b19e2cc96be5fd3b5491a7bb548cf625e385baf902

C:\backup.exe

MD5 55f2f00fbcf249329e4830b8cf1a7e71
SHA1 6e7abaf80850f2666d40a4dc675c5688100586ea
SHA256 e300e3d5ab893a01a86af6d40d8eff4e5cf1367b16344d3f6658f4910f3b4561
SHA512 db60d0ef6c126ffed85c43be33ba94c803890294029c084611baf1c352c31e3b3a96771a98998ee307ac51f8bfd03e3b621382fc4292acb511a66623afba7703

\PerfLogs\backup.exe

MD5 78045af973a44f2dddce9e3fc680c936
SHA1 ecd892df426808816bb21db1cbdb80fd2e0846c3
SHA256 ada3bccb1488fe287cb9ec7243167b0aa67b0609349bede519dd0655fc8a54c6
SHA512 c73b8c0e781815164dbfa78ccdfca6eabd42752843905d744887d59f2b065d34faebe0c1c8b292b337b72241a4a83e7d4059c1c922b30290ff6d6a7506134c6b

\PerfLogs\Admin\backup.exe

MD5 6f9856d8d1edea4c2abcf399142af087
SHA1 7cab94fbe4585268c10c9ac58482dc6d995e9c76
SHA256 c27b8001faf064c195ae81e676a2489299434ae4e2f254c38dad43e31f378fe6
SHA512 818785169c5e12fba0d6c386c783ff222349a1e3ab38b076346e03f071eef37fec284141abeb8ae9770b91aeef43fb0085a790e3f3b84e492d697e2c735e5236

\Program Files\7-Zip\Lang\backup.exe

MD5 bc79c4acdb6520a75870b3ccfc72bd97
SHA1 39aa1a115a7146356483326563320ed62a21bc03
SHA256 2ff0c466a352aa211b3d55d28b2d71541baf11684b5cadae58c5961367a5cda9
SHA512 e14322c5ea641b8b6cbfc6e6855fca838797b50bf7368d2e10d50991cdd620ac4a32c059fb05a562968b1f1da6cd725532ac6d214ed514be30b689ae4d679b6f

memory/1592-1540-0x0000000077100000-0x000000007721F000-memory.dmp

memory/1592-1541-0x0000000077220000-0x000000007731A000-memory.dmp

memory/2884-2818-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1312-3142-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2380-4289-0x00000000003A0000-0x00000000003B0000-memory.dmp

memory/1504-4339-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2684-4450-0x00000000001C0000-0x00000000001D0000-memory.dmp

memory/2684-4451-0x00000000001C0000-0x00000000001D0000-memory.dmp

memory/1920-4495-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1920-4496-0x0000000000220000-0x0000000000230000-memory.dmp

memory/888-4601-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/908-4835-0x0000000000220000-0x0000000000230000-memory.dmp

memory/908-4834-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1592-5028-0x0000000002C20000-0x0000000002D30000-memory.dmp

memory/2304-5161-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2304-5165-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1636-5583-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1636-5584-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2440-6327-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/2440-6326-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/1604-7058-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1604-7059-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2884-7289-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2884-7288-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2652-7483-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2652-7482-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2380-7954-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2696-8346-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2696-8350-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2792-11622-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2792-11621-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1696-12228-0x0000000000230000-0x0000000000240000-memory.dmp

memory/1696-12230-0x0000000000230000-0x0000000000240000-memory.dmp

memory/2820-12315-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2640-12633-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2640-12632-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1860-12697-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1860-12698-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1984-13651-0x0000000000220000-0x0000000000230000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 01:02

Reported

2024-06-02 01:05

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\Services\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Internet Explorer\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Contacts\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Java\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Internet Explorer\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\ado\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\3D Objects\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Pictures\backup.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Internet Explorer\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\appcompat\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\msadc\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\ado\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\appcompat\appraiser\Telemetry\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\7-Zip\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Pictures\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\appcompat\encapsulation\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\Ole DB\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\appcompat\appraiser\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Internet Explorer\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\VC\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\Update\Download\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\odt\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files (x86)\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\update.exe C:\Program Files\Common Files\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe C:\Program Files\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\backup.exe C:\Program Files\Java\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\uk-UA\backup.exe C:\Program Files\Common Files\System\update.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\update.exe C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe N/A
File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe C:\Program Files\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\backup.exe C:\Program Files\Common Files\System\update.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe C:\Program Files\Common Files\System\update.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\backup.exe C:\Program Files\Common Files\System\msadc\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe C:\Program Files\Common Files\System\Ole DB\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
File opened for modification C:\Program Files\Common Files\Services\backup.exe C:\Program Files\Common Files\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe C:\Program Files\Common Files\microsoft shared\VSTO\10.0\update.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe C:\Program Files\Common Files\System\Ole DB\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe C:\Program Files\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\backup.exe C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\backup.exe C:\Program Files (x86)\System Restore.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe C:\Program Files\dotnet\shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe C:\Program Files\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\addins\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\appcompat\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\backup.exe C:\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\backup.exe N/A
File opened for modification C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\AppPatch64\data.exe C:\Windows\apppatch\backup.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\odt\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files (x86)\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3936 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe
PID 3936 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe
PID 3936 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe
PID 3936 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe
PID 3936 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe
PID 3936 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe
PID 3936 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3936 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3936 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3936 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3936 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3936 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3936 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 3936 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 3936 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 4688 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe C:\backup.exe
PID 4688 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe C:\backup.exe
PID 4688 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe C:\backup.exe
PID 2440 wrote to memory of 4612 N/A C:\backup.exe C:\odt\backup.exe
PID 2440 wrote to memory of 4612 N/A C:\backup.exe C:\odt\backup.exe
PID 2440 wrote to memory of 4612 N/A C:\backup.exe C:\odt\backup.exe
PID 3936 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 3936 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 3936 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 3936 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 3936 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 3936 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2440 wrote to memory of 3996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 2440 wrote to memory of 3996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 2440 wrote to memory of 3996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 2440 wrote to memory of 3340 N/A C:\backup.exe C:\Program Files\backup.exe
PID 2440 wrote to memory of 3340 N/A C:\backup.exe C:\Program Files\backup.exe
PID 2440 wrote to memory of 3340 N/A C:\backup.exe C:\Program Files\backup.exe
PID 3936 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 3936 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 3936 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 3340 wrote to memory of 3400 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 3340 wrote to memory of 3400 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 3340 wrote to memory of 3400 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1304 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 1304 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 1304 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 1608 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 1608 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 1608 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 3936 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 3936 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 3936 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 3400 wrote to memory of 2456 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 3400 wrote to memory of 2456 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 3400 wrote to memory of 2456 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 1496 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe
PID 1496 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe
PID 1496 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe
PID 3340 wrote to memory of 3436 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 3340 wrote to memory of 3436 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 3340 wrote to memory of 3436 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 3936 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe
PID 3936 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe
PID 3936 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe
PID 3436 wrote to memory of 1568 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\System\ado\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Internet Explorer\SIGNUP\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\Desktop\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\Saved Games\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Internet Explorer\SIGNUP\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\odt\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Videos\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\System\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Documents\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Google\Chrome\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\Music\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\System\it-IT\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\Music\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Google\Update\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\appcompat\encapsulation\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\Documents\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\Downloads\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\host\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\appcompat\encapsulation\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\3D Objects\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\appcompat\appraiser\Telemetry\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\DESIGNER\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\System\msadc\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\VC\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Public\Music\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\188c7aa05b72a7d95b61d47c766d0fd0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe

C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\

C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe

C:\Users\Admin\AppData\Local\Temp\1073028319\backup.exe C:\Users\Admin\AppData\Local\Temp\1073028319\

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\backup.exe

\backup.exe \

C:\odt\backup.exe

C:\odt\backup.exe C:\odt\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\PerfLogs\backup.exe

C:\PerfLogs\backup.exe C:\PerfLogs\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\

C:\Program Files\Common Files\DESIGNER\backup.exe

"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\

C:\Program Files\Common Files\microsoft shared\backup.exe

"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\

C:\Program Files\Common Files\microsoft shared\ink\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\System Restore.exe

"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\

C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\

C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\

C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\

C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\

C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\

C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\System Restore.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\

C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\

C:\Program Files (x86)\System Restore.exe

"C:\Program Files (x86)\System Restore.exe" C:\Program Files (x86)\

C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\

C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\

C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\

C:\Program Files\dotnet\backup.exe

"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\

C:\Program Files\dotnet\host\backup.exe

"C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\

C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\

C:\Program Files\dotnet\host\fxr\backup.exe

"C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\

C:\Program Files\Common Files\microsoft shared\ink\lv-LV\System Restore.exe

"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\

C:\Program Files\dotnet\host\fxr\6.0.25\backup.exe

"C:\Program Files\dotnet\host\fxr\6.0.25\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.25\

C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\

C:\Program Files\Common Files\System\update.exe

"C:\Program Files\Common Files\System\update.exe" C:\Program Files\Common Files\System\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\

C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe

"C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe" C:\Program Files\dotnet\host\fxr\8.0.0\

C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\

C:\Program Files\Common Files\System\ado\backup.exe

"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\

C:\Program Files\dotnet\shared\backup.exe

"C:\Program Files\dotnet\shared\backup.exe" C:\Program Files\dotnet\shared\

C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\

C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\

C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\

C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\

C:\Program Files\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\

C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\

C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\

C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\

C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\

C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\

C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\

C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\

C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\

C:\Program Files\Common Files\System\fr-FR\backup.exe

"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\

C:\Program Files\Common Files\System\it-IT\backup.exe

"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\

C:\Program Files\Common Files\System\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\

C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Common Files\System\msadc\backup.exe

"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\

C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe

"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\

C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\

C:\Users\Admin\3D Objects\backup.exe

"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\

C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\

C:\Program Files\Common Files\System\msadc\fr-FR\update.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\update.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Users\Admin\Contacts\backup.exe

C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\

C:\Program Files\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Program Files\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\

C:\Program Files\Google\backup.exe

"C:\Program Files\Google\backup.exe" C:\Program Files\Google\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\

C:\Users\Admin\Documents\backup.exe

C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\

C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\

C:\Program Files\Google\Chrome\backup.exe

"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\

C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\

C:\Users\Admin\Documents\OneNote Notebooks\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\

C:\Program Files\Common Files\System\Ole DB\backup.exe

"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\

C:\Program Files\Google\Chrome\Application\backup.exe

"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\System Restore.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\update.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\update.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\

C:\Program Files\dotnet\swidtag\backup.exe

"C:\Program Files\dotnet\swidtag\backup.exe" C:\Program Files\dotnet\swidtag\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\

C:\Users\Admin\Downloads\backup.exe

C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Users\Admin\Links\update.exe

C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files\Common Files\System\uk-UA\backup.exe

"C:\Program Files\Common Files\System\uk-UA\backup.exe" C:\Program Files\Common Files\System\uk-UA\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\data.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\

C:\Users\Admin\OneDrive\backup.exe

C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\

C:\Users\Admin\Pictures\Camera Roll\backup.exe

"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\

C:\Users\Admin\Pictures\Saved Pictures\backup.exe

"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\

C:\Users\Admin\Saved Games\backup.exe

"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\

C:\Program Files\Internet Explorer\backup.exe

"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\

C:\Users\Admin\Videos\backup.exe

C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\

C:\Program Files\Internet Explorer\de-DE\backup.exe

"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Program Files\Internet Explorer\en-US\backup.exe

"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\

C:\Users\Public\data.exe

C:\Users\Public\data.exe C:\Users\Public\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3672 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\

C:\Windows\backup.exe

C:\Windows\backup.exe C:\Windows\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\

C:\Users\Public\Documents\backup.exe

C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Windows\addins\backup.exe

C:\Windows\addins\backup.exe C:\Windows\addins\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Users\Public\Downloads\backup.exe

C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\

C:\Program Files\Internet Explorer\fr-FR\backup.exe

"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\

C:\Windows\appcompat\backup.exe

C:\Windows\appcompat\backup.exe C:\Windows\appcompat\

C:\Program Files\Internet Explorer\images\backup.exe

"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\

C:\Users\Public\Music\backup.exe

C:\Users\Public\Music\backup.exe C:\Users\Public\Music\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\

C:\Program Files (x86)\Google\CrashReports\backup.exe

"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Program Files (x86)\Common Files\Java\backup.exe

"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\

C:\Users\Public\Pictures\backup.exe

C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\

C:\Program Files (x86)\Google\Temp\backup.exe

"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\

C:\Program Files (x86)\Google\Update\backup.exe

"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe

"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\

C:\Windows\appcompat\appraiser\backup.exe

C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\

C:\Program Files\Internet Explorer\it-IT\backup.exe

"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\

C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\

C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\

C:\Program Files\Internet Explorer\ja-JP\backup.exe

"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\

C:\Windows\appcompat\appraiser\Telemetry\backup.exe

C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\

C:\Program Files (x86)\Google\Update\Download\backup.exe

"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\

C:\Program Files\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\

C:\Windows\appcompat\encapsulation\backup.exe

C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\

C:\Program Files\Internet Explorer\uk-UA\backup.exe

"C:\Program Files\Internet Explorer\uk-UA\backup.exe" C:\Program Files\Internet Explorer\uk-UA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\

C:\Windows\appcompat\Programs\backup.exe

C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\

C:\Program Files (x86)\Google\Update\Install\backup.exe

"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\

C:\Windows\apppatch\backup.exe

C:\Windows\apppatch\backup.exe C:\Windows\apppatch\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\

C:\Program Files\Java\jdk-1.8\backup.exe

"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Windows\apppatch\AppPatch64\data.exe

C:\Windows\apppatch\AppPatch64\data.exe C:\Windows\apppatch\AppPatch64\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files\Java\jdk-1.8\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Program Files\Java\jdk-1.8\include\backup.exe

"C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\

C:\Windows\apppatch\Custom\backup.exe

C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Program Files\Java\jdk-1.8\include\win32\backup.exe

"C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\

C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe

"C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\

C:\Windows\apppatch\Custom\Custom64\backup.exe

C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe

"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Program Files\Java\jdk-1.8\jre\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Windows\apppatch\CustomSDB\update.exe

C:\Windows\apppatch\CustomSDB\update.exe C:\Windows\apppatch\CustomSDB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\

C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\

C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\

C:\Windows\apppatch\de-DE\backup.exe

C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Windows\apppatch\en-US\backup.exe

C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\

C:\Program Files (x86)\Internet Explorer\images\backup.exe

"C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\

C:\Windows\apppatch\es-ES\backup.exe

C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Windows\apppatch\fr-FR\backup.exe

C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\

C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\

C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Windows\apppatch\it-IT\backup.exe

C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\

C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe

"C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe" C:\Program Files (x86)\Internet Explorer\uk-UA\

C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\

C:\Windows\apppatch\ja-JP\backup.exe

C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\

C:\Program Files (x86)\Microsoft\backup.exe

"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\

C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\

C:\Windows\AppReadiness\update.exe

C:\Windows\AppReadiness\update.exe C:\Windows\AppReadiness\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\

C:\Program Files (x86)\Microsoft\Edge\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\

C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\

C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Windows\assembly\GAC\ADODB\backup.exe

C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\

C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\

C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\

C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\

C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\

C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\

C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\update.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\update.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\update.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\

C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\

C:\Program Files\Java\jdk-1.8\jre\lib\management\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\management\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\

C:\Program Files (x86)\Common Files\Oracle\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\

C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\

C:\Windows\assembly\GAC\mscomctl\backup.exe

C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\

C:\Program Files\Java\jdk-1.8\jre\lib\security\update.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\update.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\

C:\Program Files\Microsoft Office\Office16\backup.exe

"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\

C:\Program Files (x86)\Common Files\Services\update.exe

"C:\Program Files (x86)\Common Files\Services\update.exe" C:\Program Files (x86)\Common Files\Services\

C:\Program Files\Java\jre-1.8\backup.exe

"C:\Program Files\Java\jre-1.8\backup.exe" C:\Program Files\Java\jre-1.8\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\

C:\Windows\assembly\GAC\MSDATASRC\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files\Microsoft Office\PackageManifests\backup.exe

"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\

C:\Program Files (x86)\Common Files\System\backup.exe

"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\

C:\Program Files\Microsoft Office\root\backup.exe

"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\update.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Java\jre-1.8\bin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\

C:\Program Files (x86)\Common Files\System\ado\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Windows\assembly\GAC\stdole\data.exe

C:\Windows\assembly\GAC\stdole\data.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\

C:\Program Files\Java\jdk-1.8\legal\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\

C:\Program Files\Microsoft Office\root\Client\backup.exe

"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\

C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe

"C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\

C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\

C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files\Java\jre-1.8\bin\server\backup.exe

"C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\

C:\Windows\assembly\GAC_32\backup.exe

C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\

C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\

C:\Program Files\Java\jre-1.8\legal\backup.exe

"C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files\Java\jdk-1.8\lib\update.exe

"C:\Program Files\Java\jdk-1.8\lib\update.exe" C:\Program Files\Java\jdk-1.8\lib\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\System Restore.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\

C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\

C:\Program Files\Microsoft Office\root\fre\backup.exe

"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Program Files (x86)\Microsoft.NET\backup.exe

"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files\Microsoft Office\root\Integration\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\

C:\Program Files\Java\jre-1.8\lib\backup.exe

"C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\

C:\Windows\bcastdvr\update.exe

C:\Windows\bcastdvr\update.exe C:\Windows\bcastdvr\

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe

"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\

C:\Program Files (x86)\Common Files\System\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Program Files (x86)\Microsoft\EdgeCore\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\

C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\

C:\Windows\Branding\backup.exe

C:\Windows\Branding\backup.exe C:\Windows\Branding\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\

C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe

"C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\

C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe

"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\

C:\Program Files\Java\jre-1.8\lib\applet\backup.exe

"C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Program Files\Microsoft Office\root\Licenses\data.exe

"C:\Program Files\Microsoft Office\root\Licenses\data.exe" C:\Program Files\Microsoft Office\root\Licenses\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\

C:\Windows\Branding\Basebrd\backup.exe

C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\

C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\

C:\Windows\Branding\Basebrd\de-DE\backup.exe

C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\

C:\Program Files\Microsoft Office\root\Licenses16\backup.exe

"C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe

"C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\

C:\Windows\Branding\Basebrd\en-US\backup.exe

C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\

C:\Program Files (x86)\MSBuild\backup.exe

"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\

C:\Program Files\Java\jre-1.8\lib\deploy\System Restore.exe

"C:\Program Files\Java\jre-1.8\lib\deploy\System Restore.exe" C:\Program Files\Java\jre-1.8\lib\deploy\

C:\Windows\Branding\Basebrd\es-ES\backup.exe

C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Program Files (x86)\MSBuild\Microsoft\update.exe

"C:\Program Files (x86)\MSBuild\Microsoft\update.exe" C:\Program Files (x86)\MSBuild\Microsoft\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\

C:\Program Files\Microsoft Office 15\backup.exe

"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Windows\Branding\Basebrd\fr-FR\backup.exe

C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\

C:\Program Files\Java\jre-1.8\lib\ext\backup.exe

"C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\

C:\Program Files\Microsoft Office\root\loc\backup.exe

"C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\

C:\Program Files\Microsoft Office 15\ClientX64\backup.exe

"C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe

"C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\

C:\Program Files\Microsoft Office\root\Office15\backup.exe

"C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\

C:\Windows\Branding\Basebrd\it-IT\backup.exe

C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\

C:\Windows\assembly\GAC_32\MSBuild\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\

C:\Program Files\Microsoft Office\root\Office16\data.exe

"C:\Program Files\Microsoft Office\root\Office16\data.exe" C:\Program Files\Microsoft Office\root\Office16\

C:\Program Files\Mozilla Firefox\data.exe

"C:\Program Files\Mozilla Firefox\data.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\

C:\Program Files\Microsoft Office\Updates\backup.exe

"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\

C:\Program Files (x86)\Common Files\System\msadc\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\

C:\Windows\assembly\GAC_64\backup.exe

C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\

C:\Windows\Branding\Basebrd\ja-JP\backup.exe

C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\

C:\Program Files\Java\jre-1.8\lib\images\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Program Files\Microsoft Office\Updates\Apply\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\

C:\Program Files\Mozilla Firefox\browser\data.exe

"C:\Program Files\Mozilla Firefox\browser\data.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Windows\CbsTemp\backup.exe

C:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\

C:\Program Files\Microsoft Office\root\Office16\1033\update.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\update.exe" C:\Program Files\Microsoft Office\root\Office16\1033\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\

C:\Windows\assembly\GAC_32\mscorlib\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\

C:\Windows\Containers\backup.exe

C:\Windows\Containers\backup.exe C:\Windows\Containers\

C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\

C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\data.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\data.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\

C:\Program Files (x86)\Reference Assemblies\data.exe

"C:\Program Files (x86)\Reference Assemblies\data.exe" C:\Program Files (x86)\Reference Assemblies\

C:\Windows\Branding\shellbrd\backup.exe

C:\Windows\Branding\shellbrd\backup.exe C:\Windows\Branding\shellbrd\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\update.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\update.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\

C:\Windows\Branding\Basebrd\uk-UA\backup.exe

C:\Windows\Branding\Basebrd\uk-UA\backup.exe C:\Windows\Branding\Basebrd\uk-UA\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\

C:\Windows\Containers\serviced\System Restore.exe

"C:\Windows\Containers\serviced\System Restore.exe" C:\Windows\Containers\serviced\

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\

C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe

"C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe" C:\Program Files\Java\jre-1.8\lib\jfr\

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\

C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\

C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\

C:\Program Files\Microsoft Office\Updates\Download\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\

C:\Program Files\Java\jre-1.8\lib\management\backup.exe

"C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\update.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\update.exe" C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Windows\Cursors\backup.exe

C:\Windows\Cursors\backup.exe C:\Windows\Cursors\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\

C:\Program Files\Microsoft Office\root\rsod\backup.exe

"C:\Program Files\Microsoft Office\root\rsod\backup.exe" C:\Program Files\Microsoft Office\root\rsod\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\

C:\Program Files\Mozilla Firefox\defaults\data.exe

"C:\Program Files\Mozilla Firefox\defaults\data.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Windows\assembly\GAC_32\srmlib\backup.exe

C:\Windows\assembly\GAC_32\srmlib\backup.exe C:\Windows\assembly\GAC_32\srmlib\

C:\Windows\assembly\GAC_64\Microsoft.Ink\update.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\update.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\

C:\Program Files\MSBuild\Microsoft\backup.exe

"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1036\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\update.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\update.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\

C:\Program Files\Java\jre-1.8\lib\security\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\System Restore.exe

"C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\

C:\Program Files\Microsoft Office\root\Templates\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\

C:\Windows\debug\backup.exe

C:\Windows\debug\backup.exe C:\Windows\debug\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\

C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\

C:\Windows\assembly\GAC_MSIL\backup.exe

C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\

C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\

C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\

C:\Program Files (x86)\Microsoft\EdgeWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\

C:\Program Files\Mozilla Firefox\fonts\backup.exe

"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\System Restore.exe

"C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\System Restore.exe" C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\

C:\Windows\assembly\GAC_32\System.Data\backup.exe

C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\

C:\Windows\de-DE\backup.exe

C:\Windows\de-DE\backup.exe C:\Windows\de-DE\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\

C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Windows Defender\backup.exe

"C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\

C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\

C:\Windows\DiagTrack\backup.exe

C:\Windows\DiagTrack\backup.exe C:\Windows\DiagTrack\

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\

C:\Program Files (x86)\Windows Defender\de-DE\backup.exe

"C:\Program Files (x86)\Windows Defender\de-DE\backup.exe" C:\Program Files (x86)\Windows Defender\de-DE\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\

C:\Windows\DiagTrack\Scenarios\backup.exe

C:\Windows\DiagTrack\Scenarios\backup.exe C:\Windows\DiagTrack\Scenarios\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\data.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\data.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\

C:\Program Files\Mozilla Firefox\uninstall\backup.exe

"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Windows\assembly\GAC_64\MSBuild\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files (x86)\Windows Defender\es-ES\backup.exe

"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\data.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\data.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\

C:\Windows\DiagTrack\Settings\backup.exe

C:\Windows\DiagTrack\Settings\backup.exe C:\Windows\DiagTrack\Settings\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\

C:\Program Files\MsEdgeCrashpad\backup.exe

"C:\Program Files\MsEdgeCrashpad\backup.exe" C:\Program Files\MsEdgeCrashpad\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\

C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe

"C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\

C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe

"C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\System\uk-UA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\

C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\

C:\Program Files\MsEdgeCrashpad\attachments\backup.exe

"C:\Program Files\MsEdgeCrashpad\attachments\backup.exe" C:\Program Files\MsEdgeCrashpad\attachments\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\

C:\Program Files (x86)\Windows Defender\it-IT\backup.exe

"C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\

C:\Windows\DigitalLocker\backup.exe

C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\

C:\Program Files\Microsoft Office\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\backup.exe" C:\Program Files\Microsoft Office\root\vfs\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\data.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\data.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\

C:\Program Files\MsEdgeCrashpad\reports\backup.exe

"C:\Program Files\MsEdgeCrashpad\reports\backup.exe" C:\Program Files\MsEdgeCrashpad\reports\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\

C:\Windows\assembly\GAC_64\mscorlib\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\

C:\Program Files (x86)\Windows Defender\ja-JP\data.exe

"C:\Program Files (x86)\Windows Defender\ja-JP\data.exe" C:\Program Files (x86)\Windows Defender\ja-JP\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\

C:\Windows\DigitalLocker\en-US\backup.exe

C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\data.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\data.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\System Restore.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\System Restore.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\

C:\Windows\assembly\GAC_32\System.Printing\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\backup.exe C:\Windows\assembly\GAC_32\System.Printing\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\Temp\backup.exe

"C:\Program Files (x86)\Microsoft\Temp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\

C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe

"C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe" C:\Program Files (x86)\Windows Defender\uk-UA\

C:\Windows\en-US\backup.exe

C:\Windows\en-US\backup.exe C:\Windows\en-US\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\AugLoop\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\AugLoop\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\

C:\Program Files (x86)\Windows Mail\backup.exe

"C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\

C:\Windows\es-ES\backup.exe

C:\Windows\es-ES\backup.exe C:\Windows\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\

C:\Program Files (x86)\Windows Media Player\backup.exe

"C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\data.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\data.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\

C:\Windows\assembly\GAC_64\srmlib\backup.exe

C:\Windows\assembly\GAC_64\srmlib\backup.exe C:\Windows\assembly\GAC_64\srmlib\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\

C:\Windows\Fonts\data.exe

C:\Windows\Fonts\data.exe C:\Windows\Fonts\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\

C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe

"C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\

C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Windows\fr-FR\System Restore.exe

"C:\Windows\fr-FR\System Restore.exe" C:\Windows\fr-FR\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\

C:\Program Files (x86)\Windows Media Player\en-US\backup.exe

"C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\

C:\Windows\assembly\GAC_32\System.Web\backup.exe

C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\

C:\Windows\assembly\GAC_64\System.Data\backup.exe

C:\Windows\assembly\GAC_64\System.Data\backup.exe C:\Windows\assembly\GAC_64\System.Data\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe

"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\

C:\Windows\GameBarPresenceWriter\backup.exe

C:\Windows\GameBarPresenceWriter\backup.exe C:\Windows\GameBarPresenceWriter\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\System Restore.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\private\

C:\Windows\Globalization\backup.exe

C:\Windows\Globalization\backup.exe C:\Windows\Globalization\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\

C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe

"C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\

C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\update.exe

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\update.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\

C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Configuration\

C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe

"C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe" C:\Program Files (x86)\Windows Media Player\it-IT\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\

C:\Windows\Globalization\ELS\backup.exe

C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\

C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe

"C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\

C:\Windows\Globalization\ELS\Transliteration\backup.exe

C:\Windows\Globalization\ELS\Transliteration\backup.exe C:\Windows\Globalization\ELS\Transliteration\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\

C:\Program Files\Microsoft Office\root\vreg\backup.exe

"C:\Program Files\Microsoft Office\root\vreg\backup.exe" C:\Program Files\Microsoft Office\root\vreg\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe

"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\

C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe

C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\

C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\update.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\update.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\

C:\Windows\Globalization\ICU\backup.exe

C:\Windows\Globalization\ICU\backup.exe C:\Windows\Globalization\ICU\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\

C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\update.exe

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\

C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe

"C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\

C:\Windows\Globalization\Sorting\backup.exe

C:\Windows\Globalization\Sorting\backup.exe C:\Windows\Globalization\Sorting\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\System Restore.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\

C:\Windows\Globalization\Time Zone\backup.exe

"C:\Windows\Globalization\Time Zone\backup.exe" C:\Windows\Globalization\Time Zone\

C:\Windows\assembly\GAC_64\System.Printing\data.exe

C:\Windows\assembly\GAC_64\System.Printing\data.exe C:\Windows\assembly\GAC_64\System.Printing\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\update.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\

C:\Windows\Help\backup.exe

C:\Windows\Help\backup.exe C:\Windows\Help\

C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Windows Media Player\Skins\System Restore.exe

"C:\Program Files (x86)\Windows Media Player\Skins\System Restore.exe" C:\Program Files (x86)\Windows Media Player\Skins\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\

C:\Program Files\VideoLAN\VLC\backup.exe

"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\update.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\

C:\Windows\assembly\GAC_MSIL\IEExecRemote\data.exe

C:\Windows\assembly\GAC_MSIL\IEExecRemote\data.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\

C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\

C:\Program Files (x86)\Windows Media Player\uk-UA\backup.exe

"C:\Program Files (x86)\Windows Media Player\uk-UA\backup.exe" C:\Program Files (x86)\Windows Media Player\uk-UA\

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\

C:\Windows\Help\Corporate\backup.exe

C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\update.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\

C:\Windows\Help\en-US\backup.exe

C:\Windows\Help\en-US\backup.exe C:\Windows\Help\en-US\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Extensions\

C:\Program Files\VideoLAN\VLC\locale\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\FPA_f2\data.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f2\data.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\

C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe

"C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\{61562D7F-8EE6-400D-9F1C-DA0A1309A673}\backup.exe

MD5 16cb65aabdea0c940bed7d26b7e5b934
SHA1 2bce05760788f6c8bb3e2a2cbed8be85a636e17c
SHA256 59bb3d56636d44774a73a9dbf8a51e09b6cf68ce655661c4d26a35f82bf61332
SHA512 b59b679da296ba62aaf31d9a25f04ba531a6839954653f6c0b8d42e54c86dcca5f9a1b5e9e37066d79bfabdf61d2364f9f2230bda78a10444f0779f3252066ac

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

MD5 dd75d86a356e2ea6c1aa125143566bbb
SHA1 6dcfdedb9db15ae053d07f7d4c974a483be94c7d
SHA256 a37984b0a6740ecab9761c8aa66e78168e8151a9a084f9f87b87c39bb6aad32b
SHA512 79e15def60c19a22594ac983d687aafb26a4d4c6666d65119b705e9357c32bb78a6c9caa43a941a05fde122ddf64785ae82eebbd9040d0c38b3a9bb2bbd0dde2

C:\backup.exe

MD5 17ce211caad349abff1f2d3a0585748c
SHA1 69989487f9f9d1ec3e3b7dab968dd3fd80598d76
SHA256 fb81d0b2fb5078fef8b821f28ad293396105359699206a9a210840d153bc9ec5
SHA512 a6266fa0433d65baf4b035b809b1bd4e33d46e438e9aceed2da424aba9c7bb4eafa0ae9fe84e9d5084930ea80887f1c9ab57cd594a6e285b838ea90a48650578

C:\odt\backup.exe

MD5 f4dabb687b2324c5d438329c2e12fecd
SHA1 8245423f3419691752397a9accb60cce3ec39c27
SHA256 a07b408ba1c0ff547a1bbe14ef75bc6168e20a3c0bb745ecb07525d6bbcbcd6d
SHA512 97ef93693f63bfeaea2b72fa931e449a62bcb8f345f4f1aad401c629086608b67735656adaf9e186fb9ca10d5368a9aa8ffc052c38624411b31f2b0161f09536

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

MD5 86ac4f050ba35eedc365aa9ed0178529
SHA1 10bd33504cdf9da2b77c8cbc4f6f299aa91a11ed
SHA256 11e6e793bdd0a8700d3e0b84d6ebcce85f4618692bdb424a17c14aeb8810714b
SHA512 618eacf0599f20fb2040d215c7c6bc9aa770028abe66ddafe0cccd524d595d4032b2298d54b43f2c0aabd090cec2fd47ddb12b270b6924b7359ca963ef044eb8

C:\PerfLogs\backup.exe

MD5 75bdecd8d15f58386953675c85b15ad7
SHA1 971f071273b5acbacc48a0fd73237ff4ba090ba8
SHA256 cb54a8cb723d6ce6934716ba6c26cc11b924eb26303d1941689c4f254798df02
SHA512 560e69a2053b132135ca37f6ccd7aa3cb9b27bce96b6d1fe5a38a2d479f89e31f18273e1baff4af54c5bd542a466e171b8ed6c5179a3f9de9ebc9363c7b1a6c2

C:\Program Files\backup.exe

MD5 e7a866aa4ff766006ec27591544347a9
SHA1 aa493674a0f29457fb7945855da7ba1049918618
SHA256 fc7a9a6cd2f3e9a02a98afe55cdbdf818a918740c800d83b01ae2f2d24693a39
SHA512 f309a2f4a4735d25332236f3d6ebeb696277e8f5091a304c65e50e6767af5efd83c64c5d1afb007ba0e035eeaeae18d65f5e6087f738a8c38653ddb8752437ef

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

MD5 6a8c1375109119682b2e8ee89b9b4f1f
SHA1 9e56162d271174be586e31a7894670ec7f851511
SHA256 ceb59592fab036d7fbed0e097a3defc79206d74eb47390e85e9b06e02960e1df
SHA512 b010be6b4f4f9629a04f65226fcf89219478c4ea8877e843c2048ecb2dd95ad862d04b489b752077b7fd3802de68038a66303a47f82a9e9fbd4af1144f171f59

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

MD5 d6a1015f19d81cc6449cfacf0b89716b
SHA1 01c9102406a21c8852938518d6c59467f56b0579
SHA256 0d57c1663526444dc8682ce716cd28e72d8b450dc9ac0ccd2b660757a5d9212f
SHA512 b80c8b60ed3e1433a0c6bdf2b59992535367d697c23617cb969830fefe75fcf8045c47ca2e7f3fbe6b73140569d0e3d35369d5ffbe389314b0dcd14c6f3aa43e

C:\Program Files\7-Zip\backup.exe

MD5 d6d1e9724cc492427e1b957e31866a91
SHA1 3fc84f5d580cf2fc61dcc0e0643bf577eda2df74
SHA256 9f80deed0fe6ae8428ad6e763ee15d2facf212b42712a13f43e8124d3fd04bab
SHA512 4a236ae6b5b617f59f340ab33813f0bebd31c21abf0f2eacfd6f2e906f382be0663e4edc50b8308e6dba36bf3c3ed55b38b100f533200d29076b457de3f3b308

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

MD5 20f80dc19365a56286351ebb637209f3
SHA1 fbb58246b92d4386a62832923812a7bb6aa511f1
SHA256 3ec45a43d66694b20f7e56dc53963448f9e1b7e88f26fc7aef3f5aa05e222f17
SHA512 d9c3b09b4a0eff2b4d0d49cd1ec1518411552783a9fe3d41195003807d9c7afe8566d0809970490e01749f71c6fba2ffba8eeec5c99fc0cdaee2620d4c66e184

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

MD5 a515f9deb2c57ab0f0d3c3067a6c3b9f
SHA1 864126efd13dd861b21c5522be24d8df75fefdc1
SHA256 aa8cd0b9bfe17a09019f78714827d08102dc18c49baf4e75d66e9277bdb109e4
SHA512 fcc361317e27c58489dad0a4dcff4834062efbe6b6db7ac5a53f1a6ca78d4526df1ea7e83530592d02e31f38ac2e8925a4d17fe97b0228cb9b68d28e5ff278f2

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe

MD5 995714df11f59cd9a5ae8a54b034379e
SHA1 2ae517b0394dae6522b84a59fa89bf2999a21a80
SHA256 bb35bafa2f945d3765b861914f20d913b1d1841de31a1dd4bd5d2200bbcc7eb0
SHA512 9d692a67e40a88ae5e5e048c87647b264f553874274df3a3dddfc36a1c508dc2082131da7532c948bf9637264562e50928e71e7c2a89626ec1555ea55ac9499d

C:\Program Files\7-Zip\Lang\backup.exe

MD5 f82c8ace31c0cc3c33d70f4d5d489441
SHA1 941aa4fc8c944a945a798cef686c99f6d2ceacf3
SHA256 cc74d375f305886a6c42fb83532a98f1e1c9b39696b97b1cc4e66f59e6a80647
SHA512 52eae2cb1063e9fe35d404bce40fd3c1d8acf2859e3b58a3c2d463b3d0b60a0373fba4b266e4fae8fc72674a979b41c997a0cb2953f674a9e3eb61a2b1ec2d08

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\backup.exe

MD5 23ce1786553a3f313db31eef1252a92b
SHA1 ba05b3a5f8b14b6624f81544073762530f867643
SHA256 60ea37b301b719728450cb26902076b2b7a6a99a390a170ee18d6f0ce25718b4
SHA512 62aa5d96ff2c83b89fe5fd614fc9eafe21db5e3ba0e49529a7d461377d1944d68f128135716816f7922d86aa38bcc590337ebaa3b597058c0d4af79ebbe592eb

C:\Program Files\Common Files\backup.exe

MD5 a921edcc48755b201566521e8cb95318
SHA1 60e7de9a4bc51c77d074f9b26f6dda30418bddc6
SHA256 d71ce96cf939f624588d09b13e8e0c7b1412db62a60e6c98016080b5c36caa1c
SHA512 5232b4d76dd9b5a39659e632fdc9fe7a80a17c6ba3d7a20dee95cbdbe6cfbad54fc970b55c108c547575b5dac78599edfa6991c38817e64cb959a2282e88ee0e

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe

MD5 a3e9ad66459ac8861dfdb3a07475303f
SHA1 1256cf70de4dab54ced54190889957223d488d80
SHA256 382d7ae3532ba8836f4f064276a5b79296ecc8bb54acc884642229d9c2c3ae46
SHA512 b54bbbf2c3ed05f3add34d4c4f97b362f314c27a1dedef848d385ad476ba500203e0577b57cebc723ffa9efef4bcbc46ad69f81dbcb5b06722da26f8d55e0399

C:\Program Files\Common Files\DESIGNER\backup.exe

MD5 760571cf9e6c700aeb9021464c288ccb
SHA1 62d8927362d1b89b74faacf0a67cc04d4c443015
SHA256 10bb1d60e17f348766fb050ecfbdd71accf20e1696456de9abd40ab9eb38994d
SHA512 52a742b2265b12d4f8120fd5e6e8072e67ac6955cee790f42c9e36bbb3613dc3face5232e741ed5886df9ddb2a8e9d49ae279aacb03634dbf0662fd0a476e032

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe

MD5 ed01e8350d79004c4bdc2538b5459502
SHA1 ad51c05dcbb19f8cfaba108e74601fce3dd39cd9
SHA256 399fa57b1f39668bf023a0025619cb3c2457ff0f0d49969337033da92e71121a
SHA512 2999d0b1108295e77b433447a3e91beb86360e426d8984fb1cc7e72cdc2acd4474e5c1c39d25750f79afe3c107b0c8f0395546125ed4ea60369ac479aeb7a1ce

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

MD5 2fe5dfbf9c84886fa77e00153f779ac4
SHA1 a37be73bf0f6cee8bcdcde9eea3fc5d21bb482e7
SHA256 035f02ad2e4ce236712faa176a38854d1bafd2b9d89ab584eea4554fb07a65a9
SHA512 2043a04d9f8a625ae9a732ce2c419e9cb2713316d1f8f4d78351c1b4c3f33462e326a7b562dcc6ba9883164187b2786b310c1ba930a6488c91b28b3f291ee9bb

C:\Program Files\Common Files\microsoft shared\ink\backup.exe

MD5 b4a3b7b72851552cf3cab71abd25aa87
SHA1 487b24d54b88226cee17fa38841ac773403720f9
SHA256 64e4f88facf9cabf32afdba647ab58c17e793f5d4ffc95622399a81934cee69e
SHA512 fe44cc8513eba0b453a5fe5c1cdc4e829f111af5b4304fbe1434fb0d10faddf85424962f53ce9dac208bc14f3d082b52b410c98fbbd2af4a4890149260fb7907

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

MD5 bcd8aee3afaa1afbe2a49d2fa02396b1
SHA1 2ee5a89e010e5fba19d6bca684fcf28bd9ff6b52
SHA256 ed12c60c8c9f3d7757d6537fa3bcb0d07601cced4333f29e921a9a081a450782
SHA512 084e4d2f269e31d49075a8e1649fee7cb26530cfbcb3a7a25438ba8796fce855639829e89272d21e1fe10a9f4d646d537497b95d49dc3f0a3a9ec98ab1b42cfa

C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

MD5 a78d9ca40a7f4faafceda192f69e1b39
SHA1 7136e69caa0256bc8fde598fdf11bc0d07daa5af
SHA256 95f468aa7e48b7d9b4be8308a5684c528219a1a639df75d4ac7c6d767a6d0233
SHA512 5180b642359b1e909047b9affec33997e46046ce52f57de180175a7f9b476ebd1a93c8fb1d8ba0fd6202a083ba20526b9b9cdb87e566ea456d09880b54507962

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 d171306f5cbf72c6cbf1e85d3acde8a9
SHA1 df3272cab44bc11e661457389c0b0807ae74361f
SHA256 b89102cd9c69e6842b87ba5810b0ff8af25ac8a1f3826f4c7eb184211d7d378b
SHA512 f01999eebb16fcf04462de745f6d2c91255122c6e00656b48456bded829b6c2f585b46066bb11f3104d414c9fe4f5cc651cf66c6005c714004f47634f435c1e6