Malware Analysis Report

2025-01-06 11:48

Sample ID 240603-eagftaaa8t
Target ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5
SHA256 ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5

Threat Level: Known bad

The file ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5 was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Executes dropped EXE

Loads dropped DLL

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 03:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 03:44

Reported

2024-06-03 03:46

Platform

win7-20240215-en

Max time kernel

99s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jre7\lib\zi\Europe\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\FreeCell\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\System\msadc\en-US\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\System\es-ES\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\Ole DB\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Chess\de-DE\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\backup.exe N/A N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe C:\Program Files\Microsoft Games\More Games\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\backup.exe C:\Program Files\Microsoft Games\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe N/A N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe C:\Program Files\Microsoft Games\Multiplayer\backup.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe C:\Program Files (x86)\Microsoft Office\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\backup.exe C:\Program Files\Common Files\System\msadc\backup.exe N/A
File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe C:\Program Files\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe C:\Program Files\Mozilla Firefox\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\System Restore.exe C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe C:\Program Files (x86)\Common Files\System\msadc\System Restore.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe N/A N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe C:\Program Files\DVD Maker\Shared\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\update.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\data.exe C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe C:\Program Files (x86)\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\update.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe C:\Program Files\Microsoft Games\FreeCell\System Restore.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\fr-FR\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe C:\Program Files\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe C:\Program Files\Microsoft Games\Hearts\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\data.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe C:\Program Files\Java\jdk1.7.0_80\backup.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\backup.exe C:\Program Files\Reference Assemblies\backup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\backup.exe C:\Program Files\Microsoft Games\backup.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\inf\ASP.NET_4.0.30319\000A\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\d660f850b373b57c4e22a7100feeb1a4\backup.exe N/A N/A
File opened for modification C:\Windows\inf\ServiceModelService 3.0.0.0\0000\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\684eae3bcd28cb6d1e6997e6497056e2\update.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MOF\fr\backup.exe N/A N/A
File opened for modification C:\Windows\Speech\backup.exe C:\Windows\data.exe N/A
File opened for modification C:\Windows\inf\ASP.NET\000B\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\update.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\de\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\es\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\MSDTC Bridge 4.0.0.0\0012\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\0407\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehCIR\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\aspnet_state\000E\backup.exe N/A N/A
File opened for modification C:\Windows\inf\it-IT\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\update.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\backup.exe N/A N/A
File opened for modification C:\Windows\inf\aspnet_state\0009\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\inf\BITS\0407\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\backup.exe N/A N/A
File opened for modification C:\Windows\inf\ASP.NET\0009\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MIGUIControls\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\inf\usbhub\0411\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\Branding\ShellBrd\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe N/A N/A
File opened for modification C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_64\mscorlib\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\data.exe N/A N/A
File opened for modification C:\Windows\PolicyDefinitions\en-US\data.exe N/A N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\Music\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\3082\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\backup.exe C:\Windows\data.exe N/A
File opened for modification C:\Windows\inf\BITS\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\backup.exe N/A N/A
File opened for modification C:\Windows\Branding\Basebrd\backup.exe N/A N/A
File opened for modification C:\Windows\inf\SMSvcHost 3.0.0.0\0000\backup.exe N/A N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe
PID 2220 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe
PID 2220 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe
PID 2220 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe
PID 2220 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2220 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2220 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2220 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2220 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2220 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2220 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2220 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2220 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2220 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2220 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2220 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2220 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
PID 2220 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe
PID 2220 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe
PID 2220 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe
PID 2220 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe
PID 2456 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe
PID 2456 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe
PID 2456 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe
PID 2456 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe
PID 2220 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe
PID 2220 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe
PID 2220 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe
PID 2220 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe
PID 1128 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
PID 1128 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
PID 1128 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
PID 1128 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
PID 2220 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2220 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2220 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2220 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2664 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe C:\backup.exe
PID 2664 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe C:\backup.exe
PID 2664 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe C:\backup.exe
PID 2664 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe C:\backup.exe
PID 1860 wrote to memory of 624 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 624 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 624 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 624 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 624 wrote to memory of 2712 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 624 wrote to memory of 2712 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 624 wrote to memory of 2712 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 624 wrote to memory of 2712 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1860 wrote to memory of 2944 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1860 wrote to memory of 2944 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1860 wrote to memory of 2944 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1860 wrote to memory of 2944 N/A C:\backup.exe C:\Program Files\backup.exe
PID 2944 wrote to memory of 1632 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 2944 wrote to memory of 1632 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 2944 wrote to memory of 1632 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 2944 wrote to memory of 1632 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\DVD Maker\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Public\Pictures\Sample Pictures\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\VideoLAN\VLC\locale\be\System Restore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe

"C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe"

C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe

C:\Users\Admin\AppData\Local\Temp\3289524673\backup.exe C:\Users\Admin\AppData\Local\Temp\3289524673\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\

C:\backup.exe

\backup.exe \

C:\PerfLogs\backup.exe

C:\PerfLogs\backup.exe C:\PerfLogs\

C:\PerfLogs\Admin\backup.exe

C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Program Files\Common Files\Microsoft Shared\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\

C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\

C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\

C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\

C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\

C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\

C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\

C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\data.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files\Common Files\SpeechEngines\backup.exe

"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\

C:\Program Files\Common Files\SpeechEngines\Microsoft\update.exe

"C:\Program Files\Common Files\SpeechEngines\Microsoft\update.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\

C:\Program Files\Common Files\System\backup.exe

"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\

C:\Program Files\Common Files\System\ado\backup.exe

"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe

"C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files\Common Files\System\fr-FR\data.exe

"C:\Program Files\Common Files\System\fr-FR\data.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\System\it-IT\update.exe

"C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\System\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files\Common Files\System\msadc\backup.exe

"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\Common Files\System\Ole DB\data.exe

"C:\Program Files\Common Files\System\Ole DB\data.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Program Files\DVD Maker\backup.exe

"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\

C:\Program Files\DVD Maker\de-DE\backup.exe

"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\

C:\Program Files\DVD Maker\en-US\backup.exe

"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\

C:\Program Files\DVD Maker\es-ES\backup.exe

"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\

C:\Program Files\DVD Maker\fr-FR\System Restore.exe

"C:\Program Files\DVD Maker\fr-FR\System Restore.exe" C:\Program Files\DVD Maker\fr-FR\

C:\Program Files\DVD Maker\it-IT\backup.exe

"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\

C:\Program Files\DVD Maker\ja-JP\backup.exe

"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\

C:\Program Files\DVD Maker\Shared\backup.exe

"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\update.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\

C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\

C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\update.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\

C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\

C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\

C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\

C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\

C:\Program Files\Google\backup.exe

"C:\Program Files\Google\backup.exe" C:\Program Files\Google\

C:\Program Files\Google\Chrome\backup.exe

"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\

C:\Program Files\Google\Chrome\Application\backup.exe

"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\data.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Program Files\Internet Explorer\backup.exe

"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\

C:\Program Files\Internet Explorer\de-DE\backup.exe

"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Program Files\Internet Explorer\en-US\backup.exe

"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Program Files\Internet Explorer\fr-FR\data.exe

"C:\Program Files\Internet Explorer\fr-FR\data.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files\Internet Explorer\images\update.exe

"C:\Program Files\Internet Explorer\images\update.exe" C:\Program Files\Internet Explorer\images\

C:\Program Files\Internet Explorer\it-IT\backup.exe

"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Program Files\Internet Explorer\ja-JP\backup.exe

"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files\Java\jdk1.7.0_80\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\

C:\Program Files\Java\jdk1.7.0_80\db\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\

C:\Program Files\Java\jdk1.7.0_80\include\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\

C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\update.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\

C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\

C:\Program Files (x86)\backup.exe

"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\

C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\

C:\Program Files\Java\jre7\backup.exe

"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\

C:\Program Files\Java\jre7\bin\backup.exe

"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\

C:\Program Files\Java\jre7\bin\dtplugin\System Restore.exe

"C:\Program Files\Java\jre7\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jre7\bin\dtplugin\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\

C:\Program Files\Java\jre7\bin\plugin2\backup.exe

"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\

C:\Program Files\Java\jre7\bin\server\data.exe

"C:\Program Files\Java\jre7\bin\server\data.exe" C:\Program Files\Java\jre7\bin\server\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\

C:\Program Files\Java\jre7\lib\backup.exe

"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\

C:\Program Files\Java\jre7\lib\amd64\backup.exe

"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\

C:\Program Files\Java\jre7\lib\applet\backup.exe

"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\

C:\Program Files\Java\jre7\lib\cmm\backup.exe

"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\

C:\Program Files\Java\jre7\lib\deploy\backup.exe

"C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Java\jre7\lib\ext\backup.exe

"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\

C:\Program Files\Java\jre7\lib\fonts\System Restore.exe

"C:\Program Files\Java\jre7\lib\fonts\System Restore.exe" C:\Program Files\Java\jre7\lib\fonts\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\

C:\Program Files\Java\jre7\lib\images\update.exe

"C:\Program Files\Java\jre7\lib\images\update.exe" C:\Program Files\Java\jre7\lib\images\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\

C:\Program Files\Java\jre7\lib\images\cursors\System Restore.exe

"C:\Program Files\Java\jre7\lib\images\cursors\System Restore.exe" C:\Program Files\Java\jre7\lib\images\cursors\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\

C:\Program Files\Java\jre7\lib\jfr\backup.exe

"C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\

C:\Program Files\Java\jre7\lib\management\backup.exe

"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\

C:\Program Files\Java\jre7\lib\security\data.exe

"C:\Program Files\Java\jre7\lib\security\data.exe" C:\Program Files\Java\jre7\lib\security\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\

C:\Program Files\Java\jre7\lib\zi\data.exe

"C:\Program Files\Java\jre7\lib\zi\data.exe" C:\Program Files\Java\jre7\lib\zi\

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\

C:\Program Files\Java\jre7\lib\zi\America\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\

C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe

"C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\

C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\

C:\Program Files\Java\jre7\lib\zi\Antarctica\update.exe

"C:\Program Files\Java\jre7\lib\zi\Antarctica\update.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\

C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\

C:\Program Files\Java\jre7\lib\zi\Europe\System Restore.exe

"C:\Program Files\Java\jre7\lib\zi\Europe\System Restore.exe" C:\Program Files\Java\jre7\lib\zi\Europe\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\

C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\

C:\Program Files\Microsoft Games\backup.exe

"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files\Microsoft Games\Chess\backup.exe

"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files\Microsoft Games\Chess\de-DE\update.exe

"C:\Program Files\Microsoft Games\Chess\de-DE\update.exe" C:\Program Files\Microsoft Games\Chess\de-DE\

C:\Program Files\Microsoft Games\Chess\en-US\backup.exe

"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\

C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\

C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\

C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\

C:\Program Files\Microsoft Games\FreeCell\System Restore.exe

"C:\Program Files\Microsoft Games\FreeCell\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\

C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\

C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\update.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\

C:\Program Files\Microsoft Games\Hearts\System Restore.exe

"C:\Program Files\Microsoft Games\Hearts\System Restore.exe" C:\Program Files\Microsoft Games\Hearts\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\

C:\Program Files (x86)\Common Files\Adobe\Updater6\System Restore.exe

"C:\Program Files (x86)\Common Files\Adobe\Updater6\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe

"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\

C:\Program Files (x86)\Common Files\DESIGNER\backup.exe

"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\

C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\

C:\Program Files\Microsoft Games\Mahjong\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\

C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\

C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\

C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\

C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\

C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\

C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\

C:\Program Files\Microsoft Games\Minesweeper\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\

C:\Program Files\Microsoft Games\Minesweeper\en-US\update.exe

"C:\Program Files\Microsoft Games\Minesweeper\en-US\update.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\

C:\Program Files\Microsoft Games\More Games\backup.exe

"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe

"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\

C:\Program Files\Microsoft Games\More Games\en-US\backup.exe

"C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe

"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\

C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe

"C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\

C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\

C:\Program Files\Microsoft Games\Multiplayer\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\

C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\data.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\

C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\

C:\Program Files\Microsoft Games\Purble Place\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\

C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\

C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\

C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\

C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\

C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\

C:\Program Files\Microsoft Games\Solitaire\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\

C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\

C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\

C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\

C:\Program Files\Microsoft Games\Solitaire\it-IT\data.exe

"C:\Program Files\Microsoft Games\Solitaire\it-IT\data.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\

C:\Program Files\Microsoft Games\Solitaire\ja-JP\update.exe

"C:\Program Files\Microsoft Games\Solitaire\ja-JP\update.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\

C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\

C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files\Microsoft Office\Office14\backup.exe

"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\

C:\Program Files\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\

C:\Program Files\Mozilla Firefox\backup.exe

"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files\Mozilla Firefox\browser\backup.exe

"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\

C:\Program Files\Mozilla Firefox\defaults\data.exe

"C:\Program Files\Mozilla Firefox\defaults\data.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files\Mozilla Firefox\fonts\backup.exe

"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Program Files\Mozilla Firefox\uninstall\backup.exe

"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\

C:\Program Files\MSBuild\Microsoft\backup.exe

"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System Restore.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\update.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\data.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\

C:\Program Files\VideoLAN\VLC\backup.exe

"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\

C:\Program Files\VideoLAN\VLC\locale\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\

C:\Program Files\VideoLAN\VLC\locale\af\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\

C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ar\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\

C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\

C:\Program Files\VideoLAN\VLC\locale\az\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\be\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\be\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\be\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\

C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\update.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\update.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\

C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\

C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\co\data.exe

"C:\Program Files\VideoLAN\VLC\locale\co\data.exe" C:\Program Files\VideoLAN\VLC\locale\co\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\

C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\

C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\

C:\Program Files\VideoLAN\VLC\locale\da\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\

C:\Program Files\VideoLAN\VLC\locale\de\update.exe

"C:\Program Files\VideoLAN\VLC\locale\de\update.exe" C:\Program Files\VideoLAN\VLC\locale\de\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\

C:\Program Files\VideoLAN\VLC\locale\el\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Program Files\VideoLAN\VLC\locale\es\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Program Files\VideoLAN\VLC\locale\et\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\

C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\

C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\

C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\

C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\

C:\Program Files (x86)\Common Files\Services\backup.exe

"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\

C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\

C:\Program Files (x86)\Common Files\System\data.exe

"C:\Program Files (x86)\Common Files\System\data.exe" C:\Program Files (x86)\Common Files\System\

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\es-ES\update.exe

"C:\Program Files (x86)\Common Files\System\es-ES\update.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Program Files\VideoLAN\VLC\locale\he\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Program Files (x86)\Common Files\System\it-IT\update.exe

"C:\Program Files (x86)\Common Files\System\it-IT\update.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Program Files (x86)\Common Files\System\msadc\System Restore.exe

"C:\Program Files (x86)\Common Files\System\msadc\System Restore.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\update.exe

"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\msadc\en-US\data.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\data.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\data.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\data.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\

C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\

C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\id\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Users\Admin\Contacts\backup.exe

C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\

C:\Program Files\VideoLAN\VLC\locale\is\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Program Files\VideoLAN\VLC\locale\it\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\

C:\Users\Admin\Documents\System Restore.exe

"C:\Users\Admin\Documents\System Restore.exe" C:\Users\Admin\Documents\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\

C:\Users\Admin\Downloads\backup.exe

C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\

C:\Program Files (x86)\Google\CrashReports\update.exe

"C:\Program Files (x86)\Google\CrashReports\update.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Users\Admin\Links\backup.exe

C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files (x86)\Google\Temp\data.exe

"C:\Program Files (x86)\Google\Temp\data.exe" C:\Program Files (x86)\Google\Temp\

C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files (x86)\Google\Update\backup.exe

"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\

C:\Users\Admin\Saved Games\backup.exe

"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\

C:\Program Files (x86)\Google\Update\Download\data.exe

"C:\Program Files (x86)\Google\Update\Download\data.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Users\Admin\Videos\backup.exe

C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files\VideoLAN\VLC\locale\km\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\

C:\Users\Public\backup.exe

C:\Users\Public\backup.exe C:\Users\Public\

C:\Users\Public\Documents\backup.exe

C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\

C:\Program Files (x86)\Google\Update\Install\System Restore.exe

"C:\Program Files (x86)\Google\Update\Install\System Restore.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\

C:\Users\Public\Downloads\data.exe

C:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\

C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\

C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\

C:\Users\Public\Music\System Restore.exe

"C:\Users\Public\Music\System Restore.exe" C:\Users\Public\Music\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Users\Public\Music\Sample Music\backup.exe

"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\

C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Users\Public\Pictures\backup.exe

C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\update.exe

"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\en-US\data.exe

"C:\Program Files (x86)\Internet Explorer\en-US\data.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Users\Public\Pictures\Sample Pictures\backup.exe

"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\

C:\Program Files\VideoLAN\VLC\locale\ks_IN\data.exe

"C:\Program Files\VideoLAN\VLC\locale\ks_IN\data.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\

C:\Users\Public\Recorded TV\backup.exe

"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Users\Public\Recorded TV\Sample Media\backup.exe

"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\

C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Users\Public\Videos\Sample Videos\backup.exe

"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\

C:\Program Files\VideoLAN\VLC\locale\lg\update.exe

"C:\Program Files\VideoLAN\VLC\locale\lg\update.exe" C:\Program Files\VideoLAN\VLC\locale\lg\

C:\Program Files (x86)\Microsoft Analysis Services\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\

C:\Windows\data.exe

C:\Windows\data.exe C:\Windows\

C:\Windows\addins\backup.exe

C:\Windows\addins\backup.exe C:\Windows\addins\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\

C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\

C:\Windows\AppCompat\backup.exe

C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\

C:\Program Files\VideoLAN\VLC\locale\lt\update.exe

"C:\Program Files\VideoLAN\VLC\locale\lt\update.exe" C:\Program Files\VideoLAN\VLC\locale\lt\

C:\Windows\AppPatch\backup.exe

C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\

C:\Windows\AppPatch\AppPatch64\backup.exe

C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\

C:\Windows\AppPatch\Custom\backup.exe

C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\

C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\

C:\Program Files (x86)\Microsoft Office\backup.exe

"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\

C:\Windows\AppPatch\Custom\Custom64\backup.exe

C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\

C:\Windows\AppPatch\de-DE\update.exe

C:\Windows\AppPatch\de-DE\update.exe C:\Windows\AppPatch\de-DE\

C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\

C:\Windows\AppPatch\en-US\backup.exe

C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\

C:\Windows\AppPatch\es-ES\backup.exe

C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\System Restore.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\

C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\

C:\Windows\AppPatch\fr-FR\backup.exe

C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\

C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\

C:\Windows\AppPatch\it-IT\backup.exe

C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\

C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\

C:\Windows\AppPatch\ja-JP\backup.exe

C:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\

C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\

C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\

C:\Windows\assembly\GAC\ADODB\backup.exe

C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\

C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\

C:\Program Files\VideoLAN\VLC\locale\my\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\

C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\

C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\Office14\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\data.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\

C:\Windows\assembly\GAC\mscomctl\backup.exe

C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\

C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\

C:\Windows\assembly\GAC\MSDATASRC\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\

C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\data.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Windows\assembly\GAC\stdole\backup.exe

C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\data.exe

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\

C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\

C:\Windows\assembly\GAC_32\backup.exe

C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\

C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\

C:\Program Files\VideoLAN\VLC\locale\or\update.exe

"C:\Program Files\VideoLAN\VLC\locale\or\update.exe" C:\Program Files\VideoLAN\VLC\locale\or\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\data.exe

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\data.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\

C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\

C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\

C:\Windows\assembly\GAC_32\ehexthost32\backup.exe

C:\Windows\assembly\GAC_32\ehexthost32\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\

C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\

C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\update.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3289524673\backup.exe

MD5 72362d41103dcfd1da5d55ba61ac0e2c
SHA1 14ff199727ebb95f0e0aa5028890de09f3bc83f4
SHA256 0c349d0b9313a2c6c20b8694d1a2083926564ce75018d3bd13624f856b5625db
SHA512 7392251f7e8b22a2fa82df7371a6a6116f074649ea2216fb7d8acfd93fdcbfbb99af5a4ec788636c10c02b8fb4d5227f046538e2d48e3a0e0901936cafdde415

\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe

MD5 5b9acd7a615f5485a7857df975fff6e6
SHA1 c6a576bdafd5085cb55910ade61b565a441d4426
SHA256 ecc436f03eefa516e48a9e6a504fdbd72ad80e7e2315a7906dccd53e04f15ff4
SHA512 9ef1b557b115f1ceaf8a8fc8d288825c155749c724f583fd8e51d7dde4fa45f7289ff5619f9669f1bc5def860e29756301a3389d098b95e7fe80ee583e5cbabd

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 2ea0c1b628673a6d4e557a56d1c98f5d
SHA1 a188748569e3311c74ec8f5af2df51d75fa7c481
SHA256 8a725dbf0c1cad9c52a573bc4e596b4e50a6ccb3324c4599d4c80e42d6356c62
SHA512 5ab9cc08302a426f103373f5280b4e4e8016f77f32b9c565423c0ac8a5cf79207ad9736ed2ff454fa50bbcd145f7a464d2ab74f263968e2807ae8d049b6c31d1

C:\backup.exe

MD5 c31bf805669298e5839d3d647b0d3ea6
SHA1 c0796184bd76a1daaf669e35f9e672b37a3ce2b2
SHA256 5442fd857a9d05a231980732e27aa0591d66e03bdab7f34b372dae7a5f68d76e
SHA512 c94490965c90747e3c2b014fd8069881dc440ac34d64d89b6d9e4e6a2048a0fa44e6408e40ed2bc02dad9d0ce0386c4b7f7373a808c34426f690696549ad0522

\PerfLogs\backup.exe

MD5 ece906ac6021dab60d4c4b39631fb1b6
SHA1 97523cde2b24783efbcc64c704bb1a7204ee23e6
SHA256 91778ca53b6d3f5070af667cf78415efb2909500867e1df418134897be0e3b58
SHA512 f8956e33fe55b91d0300a0dce6f8c779818ce29e00b465893008751fa244d8b829de1244b15677985a7823f1ae87aae2fddc4b5b960d535b7dd754c328a6343a

\PerfLogs\Admin\backup.exe

MD5 b91608f21db20bb88e32a51943528e89
SHA1 7457fd248af4154831d594bebc9d24665c04358d
SHA256 480ecfe361d2225227b8bc1477238238f4cf7509fa97acc201352ba43f639de4
SHA512 73c69b4eabdd7842d281cf4a394f74e7213a43c94e2a353306a88f9acf1c5cc742d3bd34eb35e0411e252fe0fc009c21f809cb086b62d33a9eac0026acafe334

\Program Files\7-Zip\Lang\backup.exe

MD5 7c98a40377115bdf917f8ecc2c5f78dd
SHA1 095f978e32840cdadc4862da6b5725aab780c3e5
SHA256 de85ecd53b3a0d2c9621cf95f3f5957dc5b3e7172d9f34db9e65db5edc40e243
SHA512 59a38a426da7c5555e2714c92552577367a56c03373c7de09ba3dbd55f14e65a9088b35deeada37f3d7b4cd0bba3285f3b167d562e1fe0c583834eb2fbe22d61

memory/2244-1664-0x0000000077640000-0x000000007775F000-memory.dmp

memory/2244-1665-0x0000000077540000-0x000000007763A000-memory.dmp

memory/2244-1667-0x0000000002AD0000-0x0000000002BE0000-memory.dmp

memory/2244-1944-0x0000000077540000-0x000000007763A000-memory.dmp

memory/2948-5610-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2948-5612-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1428-5830-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1428-5831-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1608-6549-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/1608-6548-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/320-6726-0x0000000000230000-0x0000000000240000-memory.dmp

memory/1676-7081-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2956-7093-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2956-7092-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1676-7080-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1740-8115-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2008-8185-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1696-8659-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1696-8658-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2640-8989-0x0000000000240000-0x0000000000250000-memory.dmp

memory/2660-9463-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2164-9488-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2164-9487-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1304-9926-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/1304-9925-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2144-10280-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2480-10300-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1188-10577-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/1188-10579-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/3028-11118-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2012-11230-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1512-11465-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/1512-11462-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2132-11505-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2132-11504-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2244-11635-0x0000000077540000-0x000000007763A000-memory.dmp

memory/2244-11634-0x0000000077640000-0x000000007775F000-memory.dmp

memory/2208-11781-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2208-11782-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2112-11822-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2112-11821-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2424-12117-0x00000000002A0000-0x00000000002B0000-memory.dmp

memory/2424-12118-0x00000000002A0000-0x00000000002B0000-memory.dmp

memory/1580-12279-0x0000000000230000-0x0000000000240000-memory.dmp

memory/1580-12280-0x0000000000230000-0x0000000000240000-memory.dmp

memory/904-12358-0x0000000000220000-0x0000000000230000-memory.dmp

memory/904-12355-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1032-12489-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1652-12479-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1032-12490-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1652-12478-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2176-12743-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2424-12910-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2424-12912-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2568-12913-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2568-12916-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1568-13064-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2244-13740-0x0000000077640000-0x000000007775F000-memory.dmp

memory/2376-13828-0x00000000003B0000-0x00000000003C0000-memory.dmp

memory/2376-13827-0x00000000003B0000-0x00000000003C0000-memory.dmp

memory/2816-13914-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2192-14111-0x0000000000220000-0x0000000000230000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 03:44

Reported

2024-06-03 03:46

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\fr-FR\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\VC\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\Ole DB\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Google\CrashReports\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\apppatch\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Documents\OneNote Notebooks\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\bin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\apppatch\AppPatch64\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Internet Explorer\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Google\Update\Offline\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Downloads\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\ado\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft\Edge\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\msadc\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\Desktop\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\DESIGNER\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\odt\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Microsoft\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\3D Objects\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\msadc\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Internet Explorer\SIGNUP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\apppatch\en-US\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\PerfLogs\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk-1.8\jre\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\SIGNUP\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\it-IT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\apppatch\AppPatch64\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Documents\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\odt\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files (x86)\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VC\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe C:\Program Files\Common Files\System\ado\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\update.exe C:\Program Files\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe C:\Program Files (x86)\Adobe\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\backup.exe C:\Program Files\Java\jdk-1.8\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\System Restore.exe C:\Program Files\Java\jdk-1.8\jre\backup.exe N/A
File opened for modification C:\Program Files\Common Files\DESIGNER\backup.exe C:\Program Files\Common Files\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe C:\Program Files\Java\jdk-1.8\jre\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe N/A
File opened for modification C:\Program Files\7-Zip\backup.exe C:\Program Files\backup.exe N/A
File opened for modification C:\Program Files\dotnet\host\backup.exe C:\Program Files\dotnet\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe C:\Program Files (x86)\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\backup.exe C:\Program Files (x86)\Microsoft\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe C:\Program Files\Common Files\System\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe C:\Program Files (x86)\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe C:\Program Files (x86)\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe C:\Program Files\dotnet\shared\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ja-JP\backup.exe C:\Program Files\Common Files\System\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe N/A
File opened for modification C:\Program Files\Internet Explorer\images\backup.exe C:\Program Files\Internet Explorer\backup.exe N/A
File opened for modification C:\Program Files\Java\backup.exe C:\Program Files\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe C:\Program Files\Java\jdk-1.8\jre\legal\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\update.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\backup.exe C:\backup.exe N/A
File opened for modification C:\Windows\appcompat\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\apppatch\en-US\update.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\AppReadiness\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\backup.exe N/A
File opened for modification C:\Windows\addins\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\backup.exe N/A
File opened for modification C:\Windows\assembly\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\backup.exe N/A
File opened for modification C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\backup.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\odt\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files (x86)\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3192 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe
PID 3192 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe
PID 3192 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe
PID 3192 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe
PID 3192 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe
PID 3192 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe
PID 3192 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3192 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3192 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 3192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 3292 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe C:\backup.exe
PID 3292 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe C:\backup.exe
PID 3292 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe C:\backup.exe
PID 3192 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\update.exe
PID 3192 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\update.exe
PID 3192 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Low\update.exe
PID 3192 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 3192 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 3192 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2340 wrote to memory of 3076 N/A C:\backup.exe C:\odt\backup.exe
PID 2340 wrote to memory of 3076 N/A C:\backup.exe C:\odt\backup.exe
PID 2340 wrote to memory of 3076 N/A C:\backup.exe C:\odt\backup.exe
PID 3192 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 3192 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 3192 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2340 wrote to memory of 1016 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 2340 wrote to memory of 1016 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 2340 wrote to memory of 1016 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 3192 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
PID 3192 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
PID 3192 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
PID 2340 wrote to memory of 1520 N/A C:\backup.exe C:\Program Files\backup.exe
PID 2340 wrote to memory of 1520 N/A C:\backup.exe C:\Program Files\backup.exe
PID 2340 wrote to memory of 1520 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1520 wrote to memory of 2168 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1520 wrote to memory of 2168 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1520 wrote to memory of 2168 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 3192 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 3192 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 3192 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 2168 wrote to memory of 3720 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 2168 wrote to memory of 3720 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 2168 wrote to memory of 3720 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 4664 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 4664 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 4664 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 1520 wrote to memory of 2124 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 1520 wrote to memory of 2124 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 1520 wrote to memory of 2124 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 3288 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 3288 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 3288 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 2124 wrote to memory of 3620 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 2124 wrote to memory of 3620 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 2124 wrote to memory of 3620 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 3192 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 3192 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 3192 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe
PID 2124 wrote to memory of 1532 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 2124 wrote to memory of 1532 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 2124 wrote to memory of 1532 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 2728 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\Pictures\Saved Pictures\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\Services\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Public\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\Music\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\appcompat\appraiser\Telemetry\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Windows\assembly\GAC\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\Desktop\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Internet Explorer\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Internet Explorer\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Windows\apppatch\it-IT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\System\ja-JP\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Java\jdk-1.8\jre\legal\System Restore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\msadc\es-ES\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Google\Update\Download\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\assembly\GAC\Extensibility\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\ink\backup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe

"C:\Users\Admin\AppData\Local\Temp\ca0ff5f12b25625aa18e4da1e773a4bdee729743ab92499651a6fd71e1daedb5.exe"

C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe

C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\

C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe

C:\Users\Admin\AppData\Local\Temp\4078988510\backup.exe C:\Users\Admin\AppData\Local\Temp\4078988510\

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\backup.exe

\backup.exe \

C:\Users\Admin\AppData\Local\Temp\Low\update.exe

C:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\odt\backup.exe

C:\odt\backup.exe C:\odt\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\PerfLogs\backup.exe

C:\PerfLogs\backup.exe C:\PerfLogs\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\

C:\Program Files\Common Files\DESIGNER\backup.exe

"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\

C:\Program Files\Common Files\microsoft shared\backup.exe

"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\

C:\Program Files\Common Files\microsoft shared\ink\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\

C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\

C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\

C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\

C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\

C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\

C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\

C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\

C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\

C:\Program Files (x86)\backup.exe

"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\

C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\

C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\

C:\Program Files\dotnet\backup.exe

"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\

C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\

C:\Program Files\dotnet\host\backup.exe

"C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\

C:\Program Files\dotnet\host\fxr\backup.exe

"C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\

C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\

C:\Program Files\dotnet\host\fxr\6.0.25\backup.exe

"C:\Program Files\dotnet\host\fxr\6.0.25\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.25\

C:\Program Files\Common Files\System\backup.exe

"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\

C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\

C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\

C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe

"C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe" C:\Program Files\dotnet\host\fxr\8.0.0\

C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\

C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\

C:\Program Files\dotnet\shared\backup.exe

"C:\Program Files\dotnet\shared\backup.exe" C:\Program Files\dotnet\shared\

C:\Program Files\Common Files\System\ado\backup.exe

"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\

C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\

C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\

C:\Program Files\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\

C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\

C:\Program Files\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\

C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\

C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\

C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\

C:\Program Files\Common Files\System\fr-FR\data.exe

"C:\Program Files\Common Files\System\fr-FR\data.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\System\it-IT\backup.exe

"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\

C:\Program Files\Common Files\System\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\

C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\

C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe

"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\

C:\Program Files\Common Files\System\msadc\update.exe

"C:\Program Files\Common Files\System\msadc\update.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\microsoft shared\TextConv\update.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\update.exe" C:\Program Files\Common Files\microsoft shared\TextConv\

C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\

C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\

C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Common Files\System\Ole DB\backup.exe

"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Users\Admin\3D Objects\backup.exe

"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\

C:\Program Files\Google\backup.exe

"C:\Program Files\Google\backup.exe" C:\Program Files\Google\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Program Files\Google\Chrome\backup.exe

"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\

C:\Users\Admin\Contacts\backup.exe

C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Users\Admin\Documents\backup.exe

C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\

C:\Users\Admin\Documents\OneNote Notebooks\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\

C:\Program Files\Google\Chrome\Application\backup.exe

"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\

C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Program Files\dotnet\swidtag\backup.exe

"C:\Program Files\dotnet\swidtag\backup.exe" C:\Program Files\dotnet\swidtag\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\

C:\Users\Admin\Downloads\backup.exe

C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Users\Admin\Links\backup.exe

C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\

C:\Program Files\Common Files\System\uk-UA\backup.exe

"C:\Program Files\Common Files\System\uk-UA\backup.exe" C:\Program Files\Common Files\System\uk-UA\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\

C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\

C:\Users\Admin\OneDrive\backup.exe

C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\data.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\data.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\

C:\Users\Admin\Pictures\Camera Roll\System Restore.exe

"C:\Users\Admin\Pictures\Camera Roll\System Restore.exe" C:\Users\Admin\Pictures\Camera Roll\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\data.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\

C:\Users\Admin\Pictures\Saved Pictures\backup.exe

"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System Restore.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\

C:\Users\Admin\Saved Games\data.exe

"C:\Users\Admin\Saved Games\data.exe" C:\Users\Admin\Saved Games\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\

C:\Users\Admin\Videos\data.exe

C:\Users\Admin\Videos\data.exe C:\Users\Admin\Videos\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Users\Public\backup.exe

C:\Users\Public\backup.exe C:\Users\Public\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\

C:\Users\Public\Documents\data.exe

C:\Users\Public\Documents\data.exe C:\Users\Public\Documents\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\

C:\Program Files\Internet Explorer\backup.exe

"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\

C:\Users\Public\Downloads\backup.exe

C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\

C:\Program Files\Internet Explorer\de-DE\update.exe

"C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\

C:\Users\Public\Music\backup.exe

C:\Users\Public\Music\backup.exe C:\Users\Public\Music\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\

C:\Program Files\Internet Explorer\en-US\backup.exe

"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\

C:\Users\Public\Pictures\backup.exe

C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\

C:\Program Files\Internet Explorer\fr-FR\backup.exe

"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\

C:\Windows\backup.exe

C:\Windows\backup.exe C:\Windows\

C:\Program Files\Internet Explorer\images\backup.exe

"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\

C:\Windows\addins\backup.exe

C:\Windows\addins\backup.exe C:\Windows\addins\

C:\Program Files\Internet Explorer\it-IT\backup.exe

"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Windows\appcompat\backup.exe

C:\Windows\appcompat\backup.exe C:\Windows\appcompat\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Program Files\Internet Explorer\ja-JP\backup.exe

"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\

C:\Program Files\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Windows\appcompat\appraiser\backup.exe

C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\

C:\Program Files (x86)\Google\CrashReports\backup.exe

"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\

C:\Program Files\Internet Explorer\uk-UA\backup.exe

"C:\Program Files\Internet Explorer\uk-UA\backup.exe" C:\Program Files\Internet Explorer\uk-UA\

C:\Program Files (x86)\Common Files\Java\backup.exe

"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\

C:\Program Files (x86)\Google\Temp\backup.exe

"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\

C:\Windows\appcompat\appraiser\Telemetry\backup.exe

C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe

"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\

C:\Program Files (x86)\Google\Update\System Restore.exe

"C:\Program Files (x86)\Google\Update\System Restore.exe" C:\Program Files (x86)\Google\Update\

C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\

C:\Program Files\Java\jdk-1.8\backup.exe

"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\

C:\Windows\appcompat\encapsulation\backup.exe

C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Program Files\Java\jdk-1.8\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\

C:\Windows\appcompat\Programs\backup.exe

C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\

C:\Program Files\Java\jdk-1.8\include\System Restore.exe

"C:\Program Files\Java\jdk-1.8\include\System Restore.exe" C:\Program Files\Java\jdk-1.8\include\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\

C:\Windows\apppatch\backup.exe

C:\Windows\apppatch\backup.exe C:\Windows\apppatch\

C:\Program Files\Java\jdk-1.8\include\win32\backup.exe

"C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\

C:\Program Files (x86)\Google\Update\Download\backup.exe

"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe

"C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\

C:\Windows\apppatch\AppPatch64\backup.exe

C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files\Java\jdk-1.8\jre\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\

C:\Windows\apppatch\Custom\backup.exe

C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files (x86)\Google\Update\Install\backup.exe

"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\

C:\Windows\apppatch\Custom\Custom64\backup.exe

C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\

C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\

C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\

C:\Windows\apppatch\CustomSDB\backup.exe

C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Windows\apppatch\de-DE\backup.exe

C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\

C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Windows\apppatch\en-US\update.exe

C:\Windows\apppatch\en-US\update.exe C:\Windows\apppatch\en-US\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\data.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\data.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\

C:\Program Files\Java\jdk-1.8\jre\legal\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\legal\

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Windows\apppatch\es-ES\backup.exe

C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe

"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\

C:\Windows\apppatch\fr-FR\backup.exe

C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\data.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\

C:\Windows\apppatch\it-IT\backup.exe

C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\

C:\Windows\apppatch\ja-JP\backup.exe

C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\

C:\Program Files (x86)\Internet Explorer\images\backup.exe

"C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\

C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Windows\AppReadiness\backup.exe

C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\

C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\

C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\

C:\Program Files (x86)\Internet Explorer\SIGNUP\update.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\update.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Windows\assembly\GAC\ADODB\backup.exe

C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\

C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe

"C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe" C:\Program Files (x86)\Internet Explorer\uk-UA\

C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\backup.exe

"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\

C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\

C:\Program Files (x86)\Microsoft\Edge\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\

C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\

C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\

C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\

C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\

C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\EBWebView\x86\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\data.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\edge_feedback\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Windows\assembly\GAC\mscomctl\backup.exe

C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\Office16\backup.exe

"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\

C:\Program Files\Java\jdk-1.8\legal\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\

C:\Program Files (x86)\Common Files\Oracle\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\

C:\Program Files\Java\jre-1.8\update.exe

"C:\Program Files\Java\jre-1.8\update.exe" C:\Program Files\Java\jre-1.8\

C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\

C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\

C:\Windows\assembly\GAC\MSDATASRC\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\

C:\Program Files\Microsoft Office\PackageManifests\backup.exe

"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\

C:\Program Files\Java\jre-1.8\bin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\

C:\Program Files\Microsoft Office\root\backup.exe

"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\

C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\

C:\Windows\assembly\GAC\stdole\backup.exe

C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files\Java\jdk-1.8\lib\backup.exe

"C:\Program Files\Java\jdk-1.8\lib\backup.exe" C:\Program Files\Java\jdk-1.8\lib\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\

C:\Program Files (x86)\Common Files\Services\backup.exe

"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\

C:\Program Files\Microsoft Office\root\Client\backup.exe

"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\System Restore.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\

C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe

"C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\

C:\Program Files (x86)\Common Files\System\backup.exe

"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\

C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\

C:\Windows\assembly\GAC_32\data.exe

C:\Windows\assembly\GAC_32\data.exe C:\Windows\assembly\GAC_32\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files (x86)\Common Files\System\ado\System Restore.exe

"C:\Program Files (x86)\Common Files\System\ado\System Restore.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Program Files\Java\jre-1.8\bin\server\backup.exe

"C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\

C:\Program Files (x86)\Common Files\System\ado\de-DE\update.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\update.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files\Java\jre-1.8\legal\backup.exe

"C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\

C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\PdfPreview\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\System Restore.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\

C:\Program Files\Microsoft Office\root\fre\backup.exe

"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\

C:\Program Files\Java\jre-1.8\lib\backup.exe

"C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\

C:\Program Files\Microsoft Office\root\Integration\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Program Files\Java\jre-1.8\lib\amd64\update.exe

"C:\Program Files\Java\jre-1.8\lib\amd64\update.exe" C:\Program Files\Java\jre-1.8\lib\amd64\

C:\Program Files\Java\jre-1.8\lib\applet\backup.exe

"C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Common Files\System\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\

C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe

"C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Program Files\Microsoft Office\root\Licenses\backup.exe

"C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\

C:\Windows\bcastdvr\backup.exe

C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\

C:\Program Files\Microsoft Office\root\Licenses16\backup.exe

"C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\

C:\Windows\Branding\backup.exe

C:\Windows\Branding\backup.exe C:\Windows\Branding\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\

C:\Program Files (x86)\Microsoft.NET\backup.exe

"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe

"C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\

C:\Program Files (x86)\Microsoft\EdgeCore\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\

C:\Windows\Branding\Basebrd\backup.exe

C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Java\jre-1.8\lib\ext\backup.exe

"C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\update.exe

"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\update.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\

C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Windows\Branding\Basebrd\de-DE\backup.exe

C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\

C:\Windows\assembly\GAC_32\MSBuild\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\

C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe

"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\

C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe

"C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Notifications\

C:\Program Files (x86)\Common Files\System\msadc\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\

C:\Windows\Branding\Basebrd\en-US\backup.exe

C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\

C:\Program Files\Java\jre-1.8\lib\images\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\

C:\Program Files\Microsoft Office\root\loc\backup.exe

"C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\

C:\Program Files\Microsoft Office 15\backup.exe

"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\

C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Windows\Branding\Basebrd\es-ES\backup.exe

C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x64\

C:\Program Files\Microsoft Office\root\Office15\backup.exe

"C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\

C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\

C:\Windows\assembly\GAC_32\mscorlib\System Restore.exe

"C:\Windows\assembly\GAC_32\mscorlib\System Restore.exe" C:\Windows\assembly\GAC_32\mscorlib\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\EBWebView\x86\

C:\Program Files\Microsoft Office 15\ClientX64\backup.exe

"C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\

C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\

C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe

"C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe" C:\Program Files\Java\jre-1.8\lib\jfr\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\

C:\Program Files\Microsoft Office\Updates\backup.exe

"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Program Files\Microsoft Office\root\Office16\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Windows\Branding\Basebrd\fr-FR\backup.exe

C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\

C:\Windows\assembly\GAC_64\backup.exe

C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\

C:\Program Files\Microsoft Office\Updates\Apply\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\

C:\Program Files\Java\jre-1.8\lib\management\backup.exe

"C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\

C:\Program Files\Mozilla Firefox\backup.exe

"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files (x86)\MSBuild\backup.exe

"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\

C:\Windows\Branding\Basebrd\it-IT\backup.exe

C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\edge_feedback\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\

C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\

C:\Program Files\Java\jre-1.8\lib\security\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\

C:\Windows\CbsTemp\backup.exe

C:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\

C:\Program Files\Mozilla Firefox\browser\backup.exe

"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\

C:\Windows\Branding\Basebrd\ja-JP\backup.exe

C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Extensions\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\System Restore.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\

C:\Program Files\Microsoft Office\Updates\Download\data.exe

"C:\Program Files\Microsoft Office\Updates\Download\data.exe" C:\Program Files\Microsoft Office\Updates\Download\

C:\Windows\Branding\Basebrd\uk-UA\backup.exe

C:\Windows\Branding\Basebrd\uk-UA\backup.exe C:\Windows\Branding\Basebrd\uk-UA\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Windows\Containers\backup.exe

C:\Windows\Containers\backup.exe C:\Windows\Containers\

C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\

C:\Windows\Branding\shellbrd\backup.exe

C:\Windows\Branding\shellbrd\backup.exe C:\Windows\Branding\shellbrd\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\

C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\

C:\Windows\assembly\GAC_32\srmlib\System Restore.exe

"C:\Windows\assembly\GAC_32\srmlib\System Restore.exe" C:\Windows\assembly\GAC_32\srmlib\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\

C:\Windows\Containers\serviced\backup.exe

C:\Windows\Containers\serviced\backup.exe C:\Windows\Containers\serviced\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\System Restore.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\

C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\

C:\Windows\Cursors\backup.exe

C:\Windows\Cursors\backup.exe C:\Windows\Cursors\

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\

C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1036\

C:\Program Files\Mozilla Firefox\defaults\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\update.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\update.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\update.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\

C:\Windows\assembly\GAC_32\System.Data\backup.exe

C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\

C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\

C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\

C:\Windows\debug\backup.exe

C:\Windows\debug\backup.exe C:\Windows\debug\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files (x86)\Reference Assemblies\backup.exe

"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\

C:\Windows\de-DE\backup.exe

C:\Windows\de-DE\backup.exe C:\Windows\de-DE\

C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Program Files\Mozilla Firefox\fonts\backup.exe

"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\122.0.2365.52\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\

C:\Program Files\Microsoft Office\root\rsod\backup.exe

"C:\Program Files\Microsoft Office\root\rsod\backup.exe" C:\Program Files\Microsoft Office\root\rsod\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\

C:\Windows\DiagTrack\System Restore.exe

"C:\Windows\DiagTrack\System Restore.exe" C:\Windows\DiagTrack\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Windows\assembly\GAC_MSIL\backup.exe

C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System Restore.exe

"C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System Restore.exe" C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\

C:\Program Files\Microsoft Office\root\Templates\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\

C:\Windows\DiagTrack\Scenarios\backup.exe

C:\Windows\DiagTrack\Scenarios\backup.exe C:\Windows\DiagTrack\Scenarios\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\

C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\

C:\Windows\DiagTrack\Settings\backup.exe

C:\Windows\DiagTrack\Settings\backup.exe C:\Windows\DiagTrack\Settings\

C:\Program Files\Mozilla Firefox\uninstall\backup.exe

"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\EFDFFF65-1A55-4E3F-ADB6-89E563AD2004\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\PdfPreview\

C:\Windows\DigitalLocker\backup.exe

C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\System Restore.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files\MSBuild\Microsoft\backup.exe

"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\data.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\data.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\

C:\Windows\DigitalLocker\en-US\backup.exe

C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\

C:\Windows\assembly\GAC_64\MSBuild\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\data.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\data.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Windows\assembly\GAC_32\System.Printing\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\backup.exe C:\Windows\assembly\GAC_32\System.Printing\

C:\Windows\en-US\backup.exe

C:\Windows\en-US\backup.exe C:\Windows\en-US\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\

C:\Program Files (x86)\Common Files\System\uk-UA\update.exe

"C:\Program Files (x86)\Common Files\System\uk-UA\update.exe" C:\Program Files (x86)\Common Files\System\uk-UA\

C:\Windows\es-ES\System Restore.exe

"C:\Windows\es-ES\System Restore.exe" C:\Windows\es-ES\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\data.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft\EdgeWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\

C:\Windows\Fonts\backup.exe

C:\Windows\Fonts\backup.exe C:\Windows\Fonts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\data.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\data.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\

C:\Windows\assembly\GAC_64\mscorlib\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\

C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\

C:\Windows\fr-FR\backup.exe

C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\

C:\Program Files\Microsoft Office\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\backup.exe" C:\Program Files\Microsoft Office\root\vfs\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\

C:\Program Files\MsEdgeCrashpad\backup.exe

"C:\Program Files\MsEdgeCrashpad\backup.exe" C:\Program Files\MsEdgeCrashpad\

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\

C:\Windows\GameBarPresenceWriter\backup.exe

C:\Windows\GameBarPresenceWriter\backup.exe C:\Windows\GameBarPresenceWriter\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\

C:\Program Files\MsEdgeCrashpad\attachments\backup.exe

"C:\Program Files\MsEdgeCrashpad\attachments\backup.exe" C:\Program Files\MsEdgeCrashpad\attachments\

C:\Windows\assembly\GAC_32\System.Web\backup.exe

C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\

C:\Windows\Globalization\backup.exe

C:\Windows\Globalization\backup.exe C:\Windows\Globalization\

C:\Program Files (x86)\Windows Defender\backup.exe

"C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\BHO\

C:\Program Files\MsEdgeCrashpad\reports\backup.exe

"C:\Program Files\MsEdgeCrashpad\reports\backup.exe" C:\Program Files\MsEdgeCrashpad\reports\

C:\Windows\assembly\GAC_64\srmlib\backup.exe

C:\Windows\assembly\GAC_64\srmlib\backup.exe C:\Windows\assembly\GAC_64\srmlib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\

C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\

C:\Windows\Globalization\ELS\data.exe

C:\Windows\Globalization\ELS\data.exe C:\Windows\Globalization\ELS\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\

C:\Program Files (x86)\Windows Defender\de-DE\backup.exe

"C:\Program Files (x86)\Windows Defender\de-DE\backup.exe" C:\Program Files (x86)\Windows Defender\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\

C:\Windows\Globalization\ELS\Transliteration\data.exe

C:\Windows\Globalization\ELS\Transliteration\data.exe C:\Windows\Globalization\ELS\Transliteration\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\

C:\Program Files (x86)\Windows Defender\es-ES\backup.exe

"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\

C:\Windows\Globalization\ICU\backup.exe

C:\Windows\Globalization\ICU\backup.exe C:\Windows\Globalization\ICU\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x64\

C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe

"C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Windows\assembly\GAC_64\System.Data\backup.exe

C:\Windows\assembly\GAC_64\System.Data\backup.exe C:\Windows\assembly\GAC_64\System.Data\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\

C:\Windows\Globalization\Sorting\backup.exe

C:\Windows\Globalization\Sorting\backup.exe C:\Windows\Globalization\Sorting\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\x86\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\

C:\Program Files (x86)\Windows Defender\it-IT\backup.exe

"C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\update.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\

C:\Windows\Globalization\Time Zone\backup.exe

"C:\Windows\Globalization\Time Zone\backup.exe" C:\Windows\Globalization\Time Zone\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\

C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\

C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\

C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe

"C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\

C:\Windows\Help\backup.exe

C:\Windows\Help\backup.exe C:\Windows\Help\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\

C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\private\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0c5c095df94f2312c1107726858cffe2\

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe

"C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe" C:\Program Files (x86)\Windows Defender\uk-UA\

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Configuration\

C:\Windows\Help\Corporate\backup.exe

C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Windows Mail\backup.exe

"C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\

C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe

C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\

C:\Windows\Help\en-US\backup.exe

C:\Windows\Help\en-US\backup.exe C:\Windows\Help\en-US\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\

C:\Program Files (x86)\Windows Media Player\backup.exe

"C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\

C:\Windows\Help\Help\backup.exe

C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\

C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe

"C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\

C:\Windows\assembly\GAC_64\System.Printing\backup.exe

C:\Windows\assembly\GAC_64\System.Printing\backup.exe C:\Windows\assembly\GAC_64\System.Printing\

C:\Windows\Help\mui\backup.exe

C:\Windows\Help\mui\backup.exe C:\Windows\Help\mui\

C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\

C:\Program Files (x86)\Microsoft\Temp\backup.exe

"C:\Program Files (x86)\Microsoft\Temp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\System Restore.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\System Restore.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\

C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\

C:\Windows\Help\mui\0407\backup.exe

C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\

C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\

C:\Program Files (x86)\Windows Media Player\en-US\backup.exe

"C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f3\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\

C:\Program Files\Microsoft Office\root\vreg\backup.exe

"C:\Program Files\Microsoft Office\root\vreg\backup.exe" C:\Program Files\Microsoft Office\root\vreg\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files\Microsoft Office\root\Office16\FPA_f33\update.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f33\update.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f33\

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe

"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\

C:\Windows\Help\mui\0409\backup.exe

C:\Windows\Help\mui\0409\backup.exe C:\Windows\Help\mui\0409\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\

C:\Program Files\Microsoft Office\root\Office16\FPA_f4\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f4\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f4\

C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe

C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\

C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe

"C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\

C:\Windows\assembly\GAC_64\System.Web\backup.exe

C:\Windows\assembly\GAC_64\System.Web\backup.exe C:\Windows\assembly\GAC_64\System.Web\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe

"C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe" C:\Program Files (x86)\Windows Media Player\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\

C:\Windows\Help\mui\040C\backup.exe

C:\Windows\Help\mui\040C\backup.exe C:\Windows\Help\mui\040C\

C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\update.exe

C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\

C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f7\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\backup.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\backup.exe" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\PdfPreview\

C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe

"C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\

C:\Windows\Help\mui\0410\backup.exe

C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\

C:\Windows\assembly\GAC_MSIL\IEHost\update.exe

C:\Windows\assembly\GAC_MSIL\IEHost\update.exe C:\Windows\assembly\GAC_MSIL\IEHost\

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\

C:\Windows\Help\mui\0411\backup.exe

C:\Windows\Help\mui\0411\backup.exe C:\Windows\Help\mui\0411\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\{63A933A1-A2A7-42F4-8B8C-A57964658CF9}\backup.exe

MD5 42808085fb144b459b7946ab21e9b1df
SHA1 d1ccdc8973197ea0b960e316c71049ea4b603ec9
SHA256 9eef6271448a29f31a0dfb2257ba71c94f633393de4552fa5ea2523a1e74a2f4
SHA512 602e92e3e0484d0d41b20d9fbb8b9a47e934522edbcfaf90b3739fc33d8949f00eb523ff7b9ff4da81436fc260c63d8498cdac607408ba8f33224d25449a5f89

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

MD5 d6ba246c201fc69a43abbe2d66e099f2
SHA1 9d495a2c39680bb8c8c50f969f38e446ca32b21e
SHA256 c03a920e716c0f42aa5bc4106e87ba23d3531beef7d4c2ada99a340d6e7670fb
SHA512 e3fd2669961194c07d0f514213fe750d8a1cbaa01c9c086c80da9a2c5c0bf3cf46b836ecfad8402f56d621e04cb0a1abe5915bc98bb0b8024a48f0ab7b700f89

C:\backup.exe

MD5 d0ba7cb0d6b5f0037047c1edbc890e28
SHA1 6c58b878dbeae72261597a37a3efdc070a372412
SHA256 bb0fa366cdd189646b260421e84dfab55156b6552432817d40aee2a9c1a4d52f
SHA512 7f2f6b558579cda430f25d29a75fbdaf324fb9d6592ad51a5569879415ebab31ac804dc7bab3b08b3f8007cb0d6e4ddfa41cb315af266bbeecfa7851ae2aa363

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

MD5 a6bba8f44c5cfdcd65b7c4de8673566d
SHA1 8796c747b4df098fa498b6c360648ec536b7c267
SHA256 7160267350917fd903025a320433fac785a5e1073fdd6f1ba56803fbfa67ea8a
SHA512 f80b18f64b297fd5480fd59f35305d8ff246fb59780ab16e83edb9e7a1b6a218b9195b33f2385d5c95861d464ab904877f8ffffc55b3b53c8b919eea8549f7c3

C:\odt\backup.exe

MD5 77763d371b7373d3dd489437ca78086a
SHA1 2072aeb171f89406e6f664032e9e1327d6e1fc1f
SHA256 3605781e21202f8d093e509543b95b81e526902011db97fd1931d0578752d848
SHA512 8e4c4b58e6f141e106b94c66bef2dc9ec97f335e931cacdb2dbe73769810e2b703f2bf654e446855cd319c838dbe962a353b10e3dbffba934c492170db917a3f

C:\Program Files\7-Zip\backup.exe

MD5 85aad84884381b9cead69bcbd7c5435f
SHA1 3ba91b566f79d712307bf5773fb31b672721308d
SHA256 db8a3f4324082f9524f520409626253ee1adf6a75a46d34a2eeefbc0e6402dfe
SHA512 2f0a00b52d8dbd5ddb6c7d5a1afeb23e96d4e6aa142a2ddae3e0ca69c9ff7ad0682e2d950edd62d6599b35ab2168e69795a976a2ea0c987787e53b8dc9ae4f40

C:\Program Files\7-Zip\Lang\backup.exe

MD5 b03da4638f7732aa6085c87f550d439e
SHA1 1ae80c8f946e7d397bc4f592d0c101ac28847eaa
SHA256 8263b456f3b5198aaec54047449bcc60d4ade2c9e0932d4794b2bb4d96069347
SHA512 77c8fe8f53942d06af1ef0dd94a20b7a3914d597956ca828087e3c056faa0b525ac40b0dd6a83f5032b638cbbbfb5726a89ae33120628a1255cb1633f02d460b

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

MD5 85785b05cd715a7eba5bc45c8a81811f
SHA1 0541cf83e73a7a80f04e3318c80c1813c386d49c
SHA256 3d10f0f4856b668408e4ea119ecd3f8353416c8fdf97d92368fbbe06794d4521
SHA512 a1b2261c2d7fa81a783a959320261769a3136d8aab1badaf3a232819629b023e42a08c68c3c7930164bc5ccb13a9cdb8e9c549ba6ec4cf43bd378bd0be02c48b

C:\Program Files\Common Files\backup.exe

MD5 26d319c68db9ae58632ebca20cf1c7ee
SHA1 a4c58cf4bbb672b30a55d875eeefc796fafda027
SHA256 a2d21ffd15a7fba42caca67b739e3c9e38d9ee5f2c3bef1aaff9fa89cd134916
SHA512 56a3f4e0c218d03009ad6f1bd8b6002d3bbbaa68f04a88d417c83d3d78508b0c3f68c15ac1ca061a6092f0f06e88f8d876ef83e910f390a7a710fa956d23d51d

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

MD5 23b940f6489b68a9419599e5a6cc54b5
SHA1 9e45eb09f351c0649b369d532fce91aad11e6c81
SHA256 e7a8278e9c6886ba874f30d752bd5dd11469ebbd57db988eafe78432ef45adc1
SHA512 7cda5bc6b0e5de0cfa620719858d9c958139848b12afdc788655765770638352a50d3f72546a0ed278c940df9bf18cede00e1da727b21550e07efe356d9ff2f4

C:\Program Files\Common Files\DESIGNER\backup.exe

MD5 bb74b8dc6387427bd90b65903b6ed72c
SHA1 148ea2f82fb58c5100c9a3b57ea7c104fc4d6dfc
SHA256 8bcffe4e2bb221b5ef5d04b24fd7310be0abcd9dab6573c1ba013fef8e36d9b8
SHA512 c703871179aeea23aa3ddd599028259bc529838a27093d88734adf4d5279566f3c9f7305c88732c54e799810bf134e3c27f4aa1fc96062b8ca02bcc3c2e5de4a

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\backup.exe

MD5 471258b2f76d00361a389057294b0d17
SHA1 6e7256d2e00f6e29b6adafdf5b285f1e6481c5b8
SHA256 398726a95a87408c2f4b7fefa237dd333fa5bf1013fb5958f3238ae150b70c29
SHA512 653b0512709a08db3f9090b064323e4ad3abc5cf60305a2bca06aff3fbec9e5a0c8710772d38679446369a77ce053d900b5a37601e0eb74b5b4591687d8f85dd

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1383657342\CRX_INSTALL\update.exe

MD5 3545ed51bc5a01f535299620606b1741
SHA1 78535582af88ec06325b0b05ba04bde2ea6bdbf0
SHA256 8a269d3d1a7f4a75782212cb07c4cfb27f669e9337acfffa7cfa52c9c8d89de4
SHA512 5cb8f12cf233b3a7cfff8978f291599dc9940d53931db42f950f0e9cd38d80aa167fafdcd419c50fed81c5995918b383711522bce6975c486b367724d1271ded

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

MD5 a3c03f26d63a9caf58af686fd2ce9635
SHA1 fe9c9ea814f6facb53f8b42a79c7dcb4f02cd9fa
SHA256 ac943e4fbc3b901ebdfad222302823ec69f5242c9cb6efb4a94dfec4dcecec4e
SHA512 d940ec2a90b9fcb71b92a55b2aa199e77f0ddb44d6877e8846ca628e44ec394871b446cc264cfeac2e70d82dfe063e22a352e68a766abf74de5eef93d8c7615c

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\backup.exe

MD5 ceaf52ec2d4ffaf81b293a63cb2aa457
SHA1 ffb28e4011fb20fec4759b233fc4b93de12622d1
SHA256 4cad6969085f6e3ac0110f11f10960b0654ac37d3023e27bc5dbb81b656d939c
SHA512 38d6fc409bc38be1cf961c5d975463c1af1f8383c0c9aaf6ccdf60965f1d15e4d01222e741e56bd633fc044ad5359b40dd0ae04b1f64579860c8f213281ad3aa

C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1573648347\CRX_INSTALL\backup.exe

MD5 e798fccc407f5896d06f7ed61daa35aa
SHA1 bde5fed378f8335eb25bd46bfb1e725a28bed078
SHA256 96530448d5b794409ddb8390b271d22ba98a8034a74320850e28c2792848a1f9
SHA512 fd9ebc7a3cc0e4ed02cda6d5736977c11d3f8ed3e07068c6dac1244b5514161b51150882cfdf31ebfcc66fc04e07fc7cf8bbde778940fd57d364bf01714735e2

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

MD5 ce9ff7f5674449580103dd0bd7181a36
SHA1 50af9619266eab2689a9782119ac04a294c748e5
SHA256 9fffa2a02721be1c2cbb862eeb39d0d007509b1b0bd9187ed79dfd7d9641fd88
SHA512 21980ad47c176f9dd7c18f7b609096124e30d260cd44abf0b808382f172fc98cf2414fd632a6632d45bf739176d7bae5023a74af1de0acc803d518554d135264

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

MD5 b97a57cc349c20a30356ad18a4ba2ce3
SHA1 e4c581ad141b7e60f2e04d3b7570f595eee8aa76
SHA256 a2b9c08ec559f3a9648105851cc6c620bb35920ae622a971df80b186bb6ff3d4
SHA512 eed17acc15fd1f28d1cccb100f69750ee4d1d522f7a513e067dd60c9bcc8a8ea7d0021e21ffc992ba07999f098616ceefbf50685f60b171d89e1a4ecfc42daa0

C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

MD5 f50adbb1dc7782773291c3e2c05a2ad7
SHA1 c681116d3cea1373782086630f11562c269cfb77
SHA256 0d21fc787631502411a9ae11f051dcef02b5971e13c2caa624fade977580c6f6
SHA512 268d6e8c3adc684785c77cde0058d9067a56d163e60d00f10efa3f7856b3a12c0662132ea17ee210ac62e4a98980989feddf73096d54bdeeed9203bed0ddda3e

C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

MD5 f6114f248fa52aaab013b47009ce7bb6
SHA1 759e50de4af0152b9522764fd6c232326145830f
SHA256 daeba843d7a09effabfa46a697d18b77e138624d58571c202f2dd4e9c43ffa46
SHA512 2f3244e99672492cce82d05e704b50c1d9a57adb2df43d07afa4f6970270fd1faff4fcd8bb17df6558e00debbb4b5c92e0100fe190aa6f367dbfe84c8fccfe7a

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 08049c77a5630264cb0038381e06856c
SHA1 b71b1ac46b66926bef4353dbdc5167a31974ee7b
SHA256 5671364efcc6b5549dbecadb3c68d2811b3ea1e0841da9dbea091b6f189705c7
SHA512 93bad3538d8d4aabc52b34a181c08a2d0bac3f11d094acc5c5075b4d4d853003aa901b41b439550fea447d957b2f0f5cee35fe7164d6ffb482aa0be064a3b7e7