197a4356623b0fa809dfb9ad7d525819365d439093c63845059c0d07dae4c55a

Analysis

max time kernel
79s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

197a4356623b0fa809dfb9ad7d525819365d439093c63845059c0d07dae4c55a.exe
Size

72KB
MD5

8a56522b015c5cba9247e92bd12d003a
SHA1

23a84a0735733a23b4d7e86cbe4ebc68ac3d8328
SHA256

197a4356623b0fa809dfb9ad7d525819365d439093c63845059c0d07dae4c55a
SHA512

a46711b4537e80bc6ea3ae84316635c765b8da59422e01c573794e479cc19605cb395df94b3af4aaadcd0a46d6eb6e6e5212090411b8d3710266d33fa2b892ae
SSDEEP

384:x6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oGB:xpQNwC3BESe4Vqth+0V5vKlE3BEJwRrc

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\197a4356623b0fa809dfb9ad7d525819365d439093c63845059c0d07dae4c55a.exe
"C:\Users\Admin\AppData\Local\Temp\197a4356623b0fa809dfb9ad7d525819365d439093c63845059c0d07dae4c55a.exe"
1⤵
PID:1132
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2240

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:444

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:1536

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:1012

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
1⤵
PID:2804

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
1⤵
PID:2104

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
1⤵
PID:1604

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
1⤵
PID:2548

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
1⤵
PID:2228

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
1⤵
PID:2776

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2448

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2904

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
1⤵
PID:1976

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:1684

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
1⤵
PID:1616

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:2316

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:696

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:2096

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:2396

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
1⤵
PID:484

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:1640
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2412

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:1732

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:2020

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
1⤵
PID:3068

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2792
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:2648
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:2612

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:2728

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2764
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
  2⤵
  PID:1800

C:\Program Files\Common Files\Services\data.exe
"C:\Program Files\Common Files\Services\data.exe" C:\Program Files\Common Files\Services\
1⤵
PID:772

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:1508

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:2768
- C:\Program Files\Common Files\System\en-US\data.exe
  "C:\Program Files\Common Files\System\en-US\data.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:2200
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:484
- C:\Program Files\Common Files\System\msadc\backup.exe
  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
  2⤵
  PID:1832
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:1012
- - C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
    3⤵
    PID:1360
- - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
    3⤵
    PID:1732

C:\Program Files\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:1940

C:\Program Files\Common Files\System\ado\en-US\backup.exe
"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
1⤵
PID:2500

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
1⤵
PID:1472

C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
1⤵
PID:2948

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2352

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:1420

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2240

C:\Program Files\DVD Maker\fr-FR\backup.exe
"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:2468

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:2792

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2728
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:2408
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
    3⤵
    PID:2180
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
    3⤵
    PID:1684
- - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
    3⤵
    PID:2276
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
    3⤵
    PID:852
- - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
    3⤵
    PID:2536
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
    3⤵
    PID:824
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
    3⤵
    PID:3016
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
    3⤵
    PID:1856
- - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
    3⤵
    PID:1396
- - C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
    3⤵
    PID:1532

C:\Program Files\Google\Chrome\Application\backup.exe
"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
1⤵
PID:3032

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
1⤵
PID:1732

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
1⤵
PID:1296

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:2608

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:2596

C:\Program Files\Internet Explorer\images\backup.exe
"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
1⤵
PID:2676

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:2428

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
1⤵
PID:1332

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:2940

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:1160

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:2324

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:1164

C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
1⤵
PID:1988

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
1⤵
PID:920

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
1⤵
PID:2788

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
1⤵
PID:548

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
1⤵
PID:2060

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
1⤵
PID:1284

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\update.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
1⤵
PID:1420
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
  2⤵
  PID:2548

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:2504

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
1⤵
PID:2812

C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
1⤵
PID:1264

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:2744

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:2932
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
  2⤵
  PID:2284
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:584
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
  2⤵
  PID:3008
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
  2⤵
  PID:1856
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:1676
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:2004
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:2156
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1280
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
  2⤵
  PID:2548
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
  2⤵
  PID:2196
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:2440

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:612

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2628

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:2144

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
1⤵
PID:2956

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:2216

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:2904

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:1620

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:852

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:3044
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
  2⤵
  PID:2316

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:824
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:2268

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
1⤵
PID:1696

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
1⤵
PID:2152

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
1⤵
PID:904

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:1652

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:1012

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
1⤵
PID:2576

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
1⤵
PID:2448
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
  2⤵
  PID:2148

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
1⤵
PID:2732

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:1488

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2480

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
1⤵
PID:1920

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
1⤵
PID:1824

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:1816
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
  2⤵
  PID:1140
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
    3⤵
    PID:536
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
  2⤵
  PID:1548
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
  2⤵
  PID:788

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
1⤵
PID:1164

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:2920
- C:\Program Files\Java\jre7\bin\server\backup.exe
  "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
  2⤵
  PID:1500

C:\Program Files\Java\jre7\lib\backup.exe
"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
1⤵
PID:992
- C:\Program Files\Java\jre7\lib\ext\backup.exe
  "C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
  2⤵
  PID:2684
- C:\Program Files\Java\jre7\lib\images\backup.exe
  "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
  2⤵
  PID:2632
- C:\Program Files\Java\jre7\lib\jfr\update.exe
  "C:\Program Files\Java\jre7\lib\jfr\update.exe" C:\Program Files\Java\jre7\lib\jfr\
  2⤵
  PID:2512

C:\Program Files\Java\jre7\lib\zi\Africa\update.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\update.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:2240

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:2496

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
1⤵
PID:1580

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
1⤵
PID:1588

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
1⤵
PID:1804

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
1⤵
PID:888

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:656
- C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
  2⤵
  PID:2944
- C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
  2⤵
  PID:2316
- C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
  2⤵
  PID:1864

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
1⤵
PID:1532

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
1⤵
PID:2408

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
1⤵
PID:1640

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:2716

C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
1⤵
PID:3040

C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
1⤵
PID:3032

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:2792

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
1⤵
PID:772

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
1⤵
PID:2300
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
  2⤵
  PID:2952
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
  2⤵
  PID:1572
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
    3⤵
    PID:2616
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\System Restore.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
      4⤵
      PID:2752

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
1⤵
PID:1140

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
1⤵
PID:2080

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
1⤵
PID:1588

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:1788

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
1⤵
PID:2096
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
  2⤵
  PID:2124

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
1⤵
PID:996

C:\Program Files\Microsoft Games\Purble Place\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:2704
- C:\Program Files\Microsoft Games\Purble Place\en-US\data.exe
  "C:\Program Files\Microsoft Games\Purble Place\en-US\data.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
  2⤵
  PID:3004

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:3032
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:1288
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:1656

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
1⤵
PID:2712

C:\Program Files (x86)\Common Files\backup.exe
"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
1⤵
PID:2224
- C:\Program Files (x86)\Common Files\Services\backup.exe
  "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
  2⤵
  PID:1700

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
1⤵
PID:888

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2272

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
1⤵
PID:1252

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:2200

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:496
- C:\Program Files\Mozilla Firefox\browser\features\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
  2⤵
  PID:1536
- C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
  2⤵
  PID:1256

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2196

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
1⤵
PID:1516

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:400

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
1⤵
PID:3032
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:2268
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:468

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:2772

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:1860

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:1816
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
  2⤵
  PID:3004
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
  2⤵
  PID:3040

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:2556

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
1⤵
PID:2772

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
1⤵
PID:2384

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
1⤵
PID:1360

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
1⤵
PID:2364
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
  2⤵
  PID:312
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
  2⤵
  PID:2780
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
  2⤵
  PID:1772
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
  2⤵
  PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
  2⤵
  PID:1984
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
  2⤵
  PID:1640

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
1⤵
PID:2672

C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
1⤵
PID:2704

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
1⤵
PID:1744

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
1⤵
PID:1868

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
1⤵
PID:548

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
1⤵
PID:2892

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
1⤵
PID:1664

C:\Program Files\VideoLAN\VLC\locale\co\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\co\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\co\
1⤵
PID:2900

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:572

C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
1⤵
PID:1864

C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
1⤵
PID:2428

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:2168
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
  2⤵
  PID:2272
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
  2⤵
  PID:1924
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
  2⤵
  PID:1968
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
  2⤵
  PID:2884
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
  2⤵
  PID:2876
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
  2⤵
  PID:1532
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
  2⤵
  PID:2856
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
  2⤵
  PID:2028
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
  2⤵
  PID:1764
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
  2⤵
  PID:1560

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:2876

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:2412

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
1⤵
PID:2856

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
1⤵
PID:312

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:1440

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
1⤵
PID:3024

C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
1⤵
PID:1300

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
1⤵
PID:1652

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
1⤵
PID:1660

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
1⤵
PID:2364

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
1⤵
PID:2564

C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
1⤵
PID:2028

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
1⤵
PID:2580

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
1⤵
PID:1792

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
1⤵
PID:696

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\
1⤵
PID:1784

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:1788

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\
1⤵
PID:2228
- C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\
  2⤵
  PID:3004

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\
1⤵
PID:2900

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:2988

C:\Program Files (x86)\Common Files\System\ado\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
1⤵
PID:3032
- C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
  2⤵
  PID:2816

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
1⤵
PID:1288

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
1⤵
PID:2156

C:\Program Files (x86)\Common Files\System\msadc\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
1⤵
PID:2696
- C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\
  2⤵
  PID:1612

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
1⤵
PID:2500

C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
1⤵
PID:1696

C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
1⤵
PID:1632

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:1164

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:2656

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\
1⤵
PID:1656

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:3008

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\data.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\data.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
1⤵
PID:888

C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
1⤵
PID:1352

C:\Program Files (x86)\Google\Update\Offline\backup.exe
"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
1⤵
PID:2608

C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
1⤵
PID:572

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
1⤵
PID:2200

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
1⤵
PID:2604

C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
1⤵
PID:2384

C:\Program Files (x86)\Microsoft Analysis Services\data.exe
"C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\
1⤵
PID:804

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:2708

C:\Program Files\VideoLAN\VLC\locale\vi\data.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\data.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
1⤵
PID:1560

C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
1⤵
PID:2580

C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
1⤵
PID:2316

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\data.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\data.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
1⤵
PID:1764

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\
1⤵
PID:784

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
1⤵
PID:2364

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
1⤵
PID:1500

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\
1⤵
PID:2576

C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\
1⤵
PID:2732
- C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\
  2⤵
  PID:2960

C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
1⤵
PID:2928
- C:\Program Files\VideoLAN\VLC\lua\meta\art\update.exe
  "C:\Program Files\VideoLAN\VLC\lua\meta\art\update.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
  2⤵
  PID:2216

C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
1⤵
PID:2856

C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
1⤵
PID:1480

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\
1⤵
PID:1916

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\
1⤵
PID:1648

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\
1⤵
PID:2588

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
1⤵
PID:2976

C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
1⤵
PID:2184

C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:1420

C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\
1⤵
PID:1288

C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\
1⤵
PID:1804

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\
1⤵
PID:2400

C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
1⤵
PID:2744

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\
1⤵
PID:576

C:\Program Files (x86)\Microsoft Office\Office14\FORMS\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\FORMS\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\FORMS\
1⤵
PID:2456
- C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\
  2⤵
  PID:2656

C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
1⤵
PID:2104

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2600
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:880
- C:\Program Files\Windows Defender\it-IT\backup.exe
  "C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
  2⤵
  PID:2532

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\
1⤵
PID:2960

C:\Program Files\Windows Journal\en-US\backup.exe
"C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
1⤵
PID:1420

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\
1⤵
PID:1764

C:\Program Files\Windows Mail\de-DE\backup.exe
"C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
1⤵
PID:268

C:\Program Files\Windows Mail\it-IT\backup.exe
"C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
1⤵
PID:2804

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\
1⤵
PID:2196

C:\Program Files\Windows Media Player\fr-FR\backup.exe
"C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:2668

C:\Program Files\Windows Media Player\ja-JP\data.exe
"C:\Program Files\Windows Media Player\ja-JP\data.exe" C:\Program Files\Windows Media Player\ja-JP\
1⤵
PID:2708

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\
1⤵
PID:2568
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\
  2⤵
  PID:2196

C:\Users\Admin\backup.exe
C:\Users\Admin\backup.exe C:\Users\Admin\
1⤵
PID:2872
- C:\Users\Admin\Documents\backup.exe
  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
  2⤵
  PID:848
- C:\Users\Admin\Links\backup.exe
  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
  2⤵
  PID:1952
- C:\Users\Admin\Saved Games\data.exe
  "C:\Users\Admin\Saved Games\data.exe" C:\Users\Admin\Saved Games\
  2⤵
  PID:1784
- C:\Users\Admin\Searches\backup.exe
  C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
  2⤵
  PID:1872
- C:\Users\Admin\Videos\backup.exe
  C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
  2⤵
  PID:880

C:\Program Files\Windows Media Player\Visualizations\backup.exe
"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\
1⤵
PID:400

C:\Program Files\Windows NT\Accessories\de-DE\backup.exe
"C:\Program Files\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files\Windows NT\Accessories\de-DE\
1⤵
PID:1352

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\
1⤵
PID:2268

C:\Windows\addins\backup.exe
C:\Windows\addins\backup.exe C:\Windows\addins\
1⤵
PID:2440

C:\Program Files\Windows Sidebar\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\de-DE\backup.exe" C:\Program Files\Windows Sidebar\de-DE\
1⤵
PID:2852

C:\Program Files\Windows Sidebar\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\es-ES\backup.exe" C:\Program Files\Windows Sidebar\es-ES\
1⤵
PID:2224

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\
1⤵
PID:2144

C:\Windows\AppPatch\AppPatch64\backup.exe
C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
1⤵
PID:1656

C:\Program Files\Windows Sidebar\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\fr-FR\
1⤵
PID:1660

C:\Windows\AppPatch\es-ES\data.exe
C:\Windows\AppPatch\es-ES\data.exe C:\Windows\AppPatch\es-ES\
1⤵
PID:1916

C:\Windows\AppPatch\fr-FR\backup.exe
C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\
1⤵
PID:2536

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
1⤵
PID:1984

C:\Windows\AppPatch\ja-JP\update.exe
C:\Windows\AppPatch\ja-JP\update.exe C:\Windows\AppPatch\ja-JP\
1⤵
PID:1868

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
1⤵
PID:2552

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\
1⤵
PID:3040

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\
1⤵
PID:1872
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
  2⤵
  PID:2452

C:\Windows\assembly\GAC\ADODB\backup.exe
C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
1⤵
PID:2600

C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\
1⤵
PID:2508

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
1⤵
PID:1660
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
  2⤵
  PID:1276
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\
  2⤵
  PID:2560

C:\Windows\assembly\GAC\Extensibility\backup.exe
C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
1⤵
PID:2464

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\
1⤵
PID:1440
- C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\
  2⤵
  PID:2976

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\
1⤵
PID:2164

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\
1⤵
PID:1400

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
1⤵
PID:2176

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\
1⤵
PID:1160

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\
1⤵
PID:880

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:764

C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\
1⤵
PID:1432

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\
1⤵
PID:2500

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
1⤵
PID:1276

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:936

C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\
1⤵
PID:1864

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:1396

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1536

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
1⤵
PID:2864

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
1⤵
PID:2748

C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\
1⤵
PID:2704
- C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\
  2⤵
  PID:2044

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\
1⤵
PID:2856

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:312

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2680

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:1152
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:964

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
1⤵
PID:1796

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\
1⤵
PID:2124
- C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\
  2⤵
  PID:1032

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
1⤵
PID:2064

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:616
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
  2⤵
  PID:908
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\
  2⤵
  PID:2008

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:984

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2804

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1688

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\
1⤵
PID:2592
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
  2⤵
  PID:2388
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\
  2⤵
  PID:2088

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
1⤵
PID:1280
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\
  2⤵
  PID:2084

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1136

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:2768

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2708

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:2620

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\
1⤵
PID:2172

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\
1⤵
PID:2928

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
1⤵
PID:3032

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1440

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\
1⤵
PID:1632
- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1352

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\
1⤵
PID:2428

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\update.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\update.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\
1⤵
PID:2788

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\
1⤵
PID:408

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\
1⤵
PID:2940
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
  2⤵
  PID:1372
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
    3⤵
    PID:2180
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
  2⤵
  PID:1956
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\
    3⤵
    PID:1656
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\
    3⤵
    PID:2744
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\
  2⤵
  PID:2208
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
    3⤵
    PID:1744

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\
1⤵
PID:844
- C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:568

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\
1⤵
PID:2868

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\
1⤵
PID:2588
- C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1800

C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe
"C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\
1⤵
PID:908

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\
1⤵
PID:1532

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\
1⤵
PID:2688

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2132
- C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2976

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\
1⤵
PID:2292
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\
  2⤵
  PID:2936
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\
    3⤵
    PID:1964
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\
  2⤵
  PID:2848
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\
    3⤵
    PID:2124

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\
1⤵
PID:1104
- C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1352

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\
1⤵
PID:2712

C:\Windows\assembly\GAC_32\napcrypt\backup.exe
C:\Windows\assembly\GAC_32\napcrypt\backup.exe C:\Windows\assembly\GAC_32\napcrypt\
1⤵
PID:1608

C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
1⤵
PID:1684

C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1432

C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
1⤵
PID:1276

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\
1⤵
PID:1440
- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1264

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\System Restore.exe
"C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\System Restore.exe" C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1952
- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
  2⤵
  PID:2980

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:1104
- C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
  2⤵
  PID:2936

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\
1⤵
PID:2832

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\
1⤵
PID:1640

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\
1⤵
PID:2868

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\
1⤵
PID:1916

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\
1⤵
PID:2788

C:\Program Files (x86)\Reference Assemblies\backup.exe
"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:2576

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:2468
- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2080

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
1⤵
PID:2660

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\
1⤵
PID:1536

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2532

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:2564

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\
1⤵
PID:2784

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:2892

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:2412

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:1276

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:2608

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:1976

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:2552

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\
1⤵
PID:1644
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
  2⤵
  PID:2788

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
1⤵
PID:3012
- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2672

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:548

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\
1⤵
PID:2960

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\update.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\update.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
1⤵
PID:1420

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\
1⤵
PID:2732

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2080

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\
1⤵
PID:1724
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\
  2⤵
  PID:2728
- - C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
    3⤵
    PID:2072
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\
  2⤵
  PID:1872

C:\Program Files (x86)\Windows Defender\en-US\backup.exe
"C:\Program Files (x86)\Windows Defender\en-US\backup.exe" C:\Program Files (x86)\Windows Defender\en-US\
1⤵
PID:2784

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\
1⤵
PID:2368

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2516

C:\Program Files (x86)\Windows Defender\it-IT\update.exe
"C:\Program Files (x86)\Windows Defender\it-IT\update.exe" C:\Program Files (x86)\Windows Defender\it-IT\
1⤵
PID:1932

C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
1⤵
PID:568

C:\Program Files (x86)\Windows Mail\es-ES\backup.exe
"C:\Program Files (x86)\Windows Mail\es-ES\backup.exe" C:\Program Files (x86)\Windows Mail\es-ES\
1⤵
PID:2656

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\
1⤵
PID:2396

C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\
1⤵
PID:312

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:1316

C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\
1⤵
PID:1700

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\
1⤵
PID:2668

C:\Program Files (x86)\Windows NT\Accessories\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\
1⤵
PID:2176
- C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\es-ES\
  2⤵
  PID:804

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
1⤵
PID:1056

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\
1⤵
PID:1560

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
1⤵
PID:2224

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\
1⤵
PID:2368

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\
1⤵
PID:268

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:2004
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
  2⤵
  PID:1200
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\
  2⤵
  PID:1800

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1500

C:\Program Files (x86)\Windows NT\TableTextService\es-ES\data.exe
"C:\Program Files (x86)\Windows NT\TableTextService\es-ES\data.exe" C:\Program Files (x86)\Windows NT\TableTextService\es-ES\
1⤵
PID:2768

C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\
1⤵
PID:2228

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\
1⤵
PID:1600

C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\
1⤵
PID:2292

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:3012

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\
1⤵
PID:2656

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1728

C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\en-US\
1⤵
PID:2404

C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\fr-FR\
1⤵
PID:2464

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:868

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\
1⤵
PID:268
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\
  2⤵
  PID:1632
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
    3⤵
    PID:1160
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\
  2⤵
  PID:1520
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\
    3⤵
    PID:2420

C:\Program Files (x86)\Windows Sidebar\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\en-US\
1⤵
PID:2312

C:\Program Files (x86)\Windows Sidebar\es-ES\data.exe
"C:\Program Files (x86)\Windows Sidebar\es-ES\data.exe" C:\Program Files (x86)\Windows Sidebar\es-ES\
1⤵
PID:2848

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\
1⤵
PID:2328

C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2768

C:\Windows\assembly\GAC_64\MSBuild\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\
1⤵
PID:856
- C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2556

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\
1⤵
PID:2936
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\
  2⤵
  PID:2920
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
    3⤵
    PID:1772
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\
  2⤵
  PID:1832
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
  2⤵
  PID:1548

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
1⤵
PID:2208

C:\Windows\assembly\GAC_64\napcrypt\data.exe
C:\Windows\assembly\GAC_64\napcrypt\data.exe C:\Windows\assembly\GAC_64\napcrypt\
1⤵
PID:2616

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
1⤵
PID:2772

C:\Windows\assembly\GAC_64\naphlpr\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\backup.exe C:\Windows\assembly\GAC_64\naphlpr\
1⤵
PID:2564

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\
1⤵
PID:952

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:468

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\
1⤵
PID:772

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\
1⤵
PID:1252
- C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2480

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:2836

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
1⤵
PID:2384

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\
1⤵
PID:2696

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1600

C:\Program Files\Windows Sidebar\ja-JP\data.exe
"C:\Program Files\Windows Sidebar\ja-JP\data.exe" C:\Program Files\Windows Sidebar\ja-JP\
1⤵
PID:612

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\data.exe
C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\data.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:600

C:\Windows\assembly\GAC_64\System.Printing\backup.exe
C:\Windows\assembly\GAC_64\System.Printing\backup.exe C:\Windows\assembly\GAC_64\System.Printing\
1⤵
PID:2684

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\
1⤵
PID:2420

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
1⤵
PID:3036

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
1⤵
PID:2368

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\
1⤵
PID:896

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\
1⤵
PID:2960

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:2940

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1668

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
1⤵
PID:1644

C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\
1⤵
PID:1972

C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\
1⤵
PID:2808

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
1⤵
PID:876

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
1⤵
PID:2788

C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\
1⤵
PID:1792

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
1⤵
PID:1628

C:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exe
C:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\
1⤵
PID:1536

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
1⤵
PID:1640

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1360

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2268

C:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exe
C:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\
1⤵
PID:2292
- C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\
  2⤵
  PID:312

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\
1⤵
PID:2244
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
  2⤵
  PID:2576
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\
  2⤵
  PID:2568

C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1332

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
1⤵
PID:2340

C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\
1⤵
PID:3032

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
1⤵
PID:1104

C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1952

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\
1⤵
PID:1732
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
  2⤵
  PID:1440

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1764

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\
1⤵
PID:2692

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2548

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\
1⤵
PID:584

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2564

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1712

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:1988

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
1⤵
PID:936

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:832

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\
1⤵
PID:1816

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:856

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2632

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:1568
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
  2⤵
  PID:312

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\
1⤵
PID:1516

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\
1⤵
PID:908
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:1804

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\
1⤵
PID:2956

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\
1⤵
PID:1944
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1052

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\
1⤵
PID:2180

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\
1⤵
PID:2664

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:2908

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
1⤵
PID:2876

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\
1⤵
PID:1472

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\
1⤵
PID:696
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:704

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\
1⤵
PID:2168

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
1⤵
PID:1316

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\
1⤵
PID:788
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
  2⤵
  PID:1824

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:848

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2944

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1432

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\
1⤵
PID:2848

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\
1⤵
PID:2836
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
  2⤵
  PID:2384

C:\Windows\Branding\Basebrd\es-ES\data.exe
C:\Windows\Branding\Basebrd\es-ES\data.exe C:\Windows\Branding\Basebrd\es-ES\
1⤵
PID:2008

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\
1⤵
PID:3008

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2672

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:612

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\
1⤵
PID:3016
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:616
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1508

C:\Windows\debug\WIA\backup.exe
C:\Windows\debug\WIA\backup.exe C:\Windows\debug\WIA\
1⤵
PID:2620

C:\Windows\de-DE\backup.exe
C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
1⤵
PID:2860

C:\Windows\DigitalLocker\de-DE\backup.exe
C:\Windows\DigitalLocker\de-DE\backup.exe C:\Windows\DigitalLocker\de-DE\
1⤵
PID:320

C:\Windows\DigitalLocker\es-ES\backup.exe
C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
1⤵
PID:2836

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\
1⤵
PID:2656
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
  2⤵
  PID:408

C:\Windows\ehome\CreateDisc\Components\System Restore.exe
"C:\Windows\ehome\CreateDisc\Components\System Restore.exe" C:\Windows\ehome\CreateDisc\Components\
1⤵
PID:1372

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1088

C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\
1⤵
PID:1140

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2328

C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\
1⤵
PID:1860

C:\Windows\ehome\es-ES\backup.exe
C:\Windows\ehome\es-ES\backup.exe C:\Windows\ehome\es-ES\
1⤵
PID:536

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1788

C:\Windows\ehome\fr-FR\backup.exe
C:\Windows\ehome\fr-FR\backup.exe C:\Windows\ehome\fr-FR\
1⤵
PID:3044

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\
1⤵
PID:1580
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2472

C:\Windows\ehome\MCX\backup.exe
C:\Windows\ehome\MCX\backup.exe C:\Windows\ehome\MCX\
1⤵
PID:1476

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\
1⤵
PID:576

C:\Windows\ehome\wow\de-DE\backup.exe
C:\Windows\ehome\wow\de-DE\backup.exe C:\Windows\ehome\wow\de-DE\
1⤵
PID:2624

C:\Windows\ehome\wow\it-IT\backup.exe
C:\Windows\ehome\wow\it-IT\backup.exe C:\Windows\ehome\wow\it-IT\
1⤵
PID:2976

C:\Windows\es-ES\update.exe
C:\Windows\es-ES\update.exe C:\Windows\es-ES\
1⤵
PID:1400

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1664

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\
1⤵
PID:2072

C:\Windows\Globalization\ELS\Transliteration\backup.exe
C:\Windows\Globalization\ELS\Transliteration\backup.exe C:\Windows\Globalization\ELS\Transliteration\
1⤵
PID:840

C:\Windows\Help\backup.exe
C:\Windows\Help\backup.exe C:\Windows\Help\
1⤵
PID:2688
- C:\Windows\Help\Help\backup.exe
  C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
  2⤵
  PID:2924
- - C:\Windows\Help\Help\fr-FR\backup.exe
    C:\Windows\Help\Help\fr-FR\backup.exe C:\Windows\Help\Help\fr-FR\
    3⤵
    PID:484
- - C:\Windows\Help\Help\ja-JP\backup.exe
    C:\Windows\Help\Help\ja-JP\backup.exe C:\Windows\Help\Help\ja-JP\
    3⤵
    PID:2476

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\
1⤵
PID:704

C:\Windows\Help\Windows\fr-FR\backup.exe
C:\Windows\Help\Windows\fr-FR\backup.exe C:\Windows\Help\Windows\fr-FR\
1⤵
PID:2216

C:\Windows\Help\Windows\it-IT\backup.exe
C:\Windows\Help\Windows\it-IT\backup.exe C:\Windows\Help\Windows\it-IT\
1⤵
PID:1576

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1252

C:\Windows\IME\backup.exe
C:\Windows\IME\backup.exe C:\Windows\IME\
1⤵
PID:2028
- C:\Windows\IME\en-US\backup.exe
  C:\Windows\IME\en-US\backup.exe C:\Windows\IME\en-US\
  2⤵
  PID:2600
- C:\Windows\IME\fr-FR\backup.exe
  C:\Windows\IME\fr-FR\backup.exe C:\Windows\IME\fr-FR\
  2⤵
  PID:484
- C:\Windows\IME\it-IT\backup.exe
  C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
  2⤵
  PID:1944

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1532

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1156

C:\Windows\IME\IMEJP10\help\backup.exe
C:\Windows\IME\IMEJP10\help\backup.exe C:\Windows\IME\IMEJP10\help\
1⤵
PID:2572

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\
1⤵
PID:868

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\
1⤵
PID:1804

C:\Windows\IME\IMESC5\HELP\backup.exe
C:\Windows\IME\IMESC5\HELP\backup.exe C:\Windows\IME\IMESC5\HELP\
1⤵
PID:936

C:\Windows\inf\backup.exe
C:\Windows\inf\backup.exe C:\Windows\inf\
1⤵
PID:1916
- C:\Windows\inf\ASP.NET\backup.exe
  C:\Windows\inf\ASP.NET\backup.exe C:\Windows\inf\ASP.NET\
  2⤵
  PID:2836
- - C:\Windows\inf\ASP.NET\0009\backup.exe
    C:\Windows\inf\ASP.NET\0009\backup.exe C:\Windows\inf\ASP.NET\0009\
    3⤵
    PID:352
- - C:\Windows\inf\ASP.NET\000B\backup.exe
    C:\Windows\inf\ASP.NET\000B\backup.exe C:\Windows\inf\ASP.NET\000B\
    3⤵
    PID:2404
- - C:\Windows\inf\ASP.NET\000E\System Restore.exe
    "C:\Windows\inf\ASP.NET\000E\System Restore.exe" C:\Windows\inf\ASP.NET\000E\
    3⤵
    PID:2020
- - C:\Windows\inf\ASP.NET\0011\backup.exe
    C:\Windows\inf\ASP.NET\0011\backup.exe C:\Windows\inf\ASP.NET\0011\
    3⤵
    PID:676
- - C:\Windows\inf\ASP.NET\001D\backup.exe
    C:\Windows\inf\ASP.NET\001D\backup.exe C:\Windows\inf\ASP.NET\001D\
    3⤵
    PID:888
- C:\Windows\inf\BITS\backup.exe
  C:\Windows\inf\BITS\backup.exe C:\Windows\inf\BITS\
  2⤵
  PID:2864
- - C:\Windows\inf\BITS\0411\backup.exe
    C:\Windows\inf\BITS\0411\backup.exe C:\Windows\inf\BITS\0411\
    3⤵
    PID:2956
- C:\Windows\inf\fr-FR\backup.exe
  C:\Windows\inf\fr-FR\backup.exe C:\Windows\inf\fr-FR\
  2⤵
  PID:1728
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\
  2⤵
  PID:1328
- - C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\data.exe
    "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\data.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\
    3⤵
    PID:2900
- - C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\
    3⤵
    PID:2864
- C:\Windows\inf\wsearchidxpi\backup.exe
  C:\Windows\inf\wsearchidxpi\backup.exe C:\Windows\inf\wsearchidxpi\
  2⤵
  PID:2380
- - C:\Windows\inf\wsearchidxpi\0000\backup.exe
    C:\Windows\inf\wsearchidxpi\0000\backup.exe C:\Windows\inf\wsearchidxpi\0000\
    3⤵
    PID:1784
- - C:\Windows\inf\wsearchidxpi\0407\backup.exe
    C:\Windows\inf\wsearchidxpi\0407\backup.exe C:\Windows\inf\wsearchidxpi\0407\
    3⤵
    PID:1576
- - C:\Windows\inf\wsearchidxpi\0411\backup.exe
    C:\Windows\inf\wsearchidxpi\0411\backup.exe C:\Windows\inf\wsearchidxpi\0411\
    3⤵
    PID:840

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\
1⤵
PID:1296

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2680

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\
1⤵
PID:776

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
1⤵
PID:3036

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\
1⤵
PID:2268

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:2908
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1472

C:\Windows\inf\ASP.NET_4.0.30319\0007\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0007\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0007\
1⤵
PID:856

C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0009\
1⤵
PID:656

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1488

C:\Windows\inf\ASP.NET_4.0.30319\000B\update.exe
C:\Windows\inf\ASP.NET_4.0.30319\000B\update.exe C:\Windows\inf\ASP.NET_4.0.30319\000B\
1⤵
PID:2296

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1276

C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000D\
1⤵
PID:2420

C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\
1⤵
PID:2308

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2972

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:3024

C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0014\
1⤵
PID:916

C:\Windows\inf\ASP.NET_4.0.30319\0019\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0019\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0019\
1⤵
PID:2604

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2396

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:952

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\
1⤵
PID:312

C:\Windows\inf\aspnet_state\0000\backup.exe
C:\Windows\inf\aspnet_state\0000\backup.exe C:\Windows\inf\aspnet_state\0000\
1⤵
PID:2244

C:\Windows\inf\aspnet_state\0005\backup.exe
C:\Windows\inf\aspnet_state\0005\backup.exe C:\Windows\inf\aspnet_state\0005\
1⤵
PID:2900

C:\Windows\inf\aspnet_state\000C\backup.exe
C:\Windows\inf\aspnet_state\000C\backup.exe C:\Windows\inf\aspnet_state\000C\
1⤵
PID:2568

C:\Windows\inf\aspnet_state\0010\backup.exe
C:\Windows\inf\aspnet_state\0010\backup.exe C:\Windows\inf\aspnet_state\0010\
1⤵
PID:2792

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:3016

C:\Windows\inf\aspnet_state\0013\backup.exe
C:\Windows\inf\aspnet_state\0013\backup.exe C:\Windows\inf\aspnet_state\0013\
1⤵
PID:1724

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1476

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\
1⤵
PID:332

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\
1⤵
PID:856
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:964
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:400

C:\Windows\inf\aspnet_state\0816\backup.exe
C:\Windows\inf\aspnet_state\0816\backup.exe C:\Windows\inf\aspnet_state\0816\
1⤵
PID:1864

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\
1⤵
PID:1780

C:\Windows\inf\ESENT\0407\backup.exe
C:\Windows\inf\ESENT\0407\backup.exe C:\Windows\inf\ESENT\0407\
1⤵
PID:2268

C:\Windows\inf\ESENT\0411\backup.exe
C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
1⤵
PID:1784

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1628

C:\Windows\inf\MSDTC\0410\backup.exe
C:\Windows\inf\MSDTC\0410\backup.exe C:\Windows\inf\MSDTC\0410\
1⤵
PID:856

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2896

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\
1⤵
PID:2024

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\
1⤵
PID:2360

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1600

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1476

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2624

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:612

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\
1⤵
PID:2900

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1136

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1712

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\update.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\update.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\
1⤵
PID:1932

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\
1⤵
PID:1256

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\
1⤵
PID:3040
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2688

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0014\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0014\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0014\
1⤵
PID:1868

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\data.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\data.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\
1⤵
PID:2716

C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\
1⤵
PID:2088

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1516

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0416\System Restore.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0416\System Restore.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0416\
1⤵
PID:2576

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\
1⤵
PID:2332

C:\Windows\inf\PERFLIB\0407\backup.exe
C:\Windows\inf\PERFLIB\0407\backup.exe C:\Windows\inf\PERFLIB\0407\
1⤵
PID:1588

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\
1⤵
PID:2984

C:\Windows\inf\PERFLIB\040C\backup.exe
C:\Windows\inf\PERFLIB\040C\backup.exe C:\Windows\inf\PERFLIB\040C\
1⤵
PID:2952

C:\Windows\inf\PERFLIB\0411\backup.exe
C:\Windows\inf\PERFLIB\0411\backup.exe C:\Windows\inf\PERFLIB\0411\
1⤵
PID:1052

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\
1⤵
PID:2260

C:\Windows\inf\PNRPSvc\0407\backup.exe
C:\Windows\inf\PNRPSvc\0407\backup.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:776

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\
1⤵
PID:2252

C:\Windows\inf\PNRPSvc\040C\data.exe
C:\Windows\inf\PNRPSvc\040C\data.exe C:\Windows\inf\PNRPSvc\040C\
1⤵
PID:2380

C:\Windows\inf\PNRPSvc\0C0A\backup.exe
C:\Windows\inf\PNRPSvc\0C0A\backup.exe C:\Windows\inf\PNRPSvc\0C0A\
1⤵
PID:496

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\
1⤵
PID:2936
- C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1372

C:\Windows\inf\rdyboost\0000\backup.exe
C:\Windows\inf\rdyboost\0000\backup.exe C:\Windows\inf\rdyboost\0000\
1⤵
PID:484

C:\Windows\inf\rdyboost\0407\backup.exe
C:\Windows\inf\rdyboost\0407\backup.exe C:\Windows\inf\rdyboost\0407\
1⤵
PID:2940

C:\Windows\inf\rdyboost\0410\backup.exe
C:\Windows\inf\rdyboost\0410\backup.exe C:\Windows\inf\rdyboost\0410\
1⤵
PID:2908

C:\Windows\inf\rdyboost\0C0A\backup.exe
C:\Windows\inf\rdyboost\0C0A\backup.exe C:\Windows\inf\rdyboost\0C0A\
1⤵
PID:2980

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:468

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2744

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\
1⤵
PID:1684

C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\
1⤵
PID:2060

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\data.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\data.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\
1⤵
PID:2948

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2904

C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\
1⤵
PID:1668

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\
1⤵
PID:2592

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\
1⤵
PID:400
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
  2⤵
  PID:2860
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:2956

C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\
1⤵
PID:1400

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\
1⤵
PID:2676

C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\
1⤵
PID:2308

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0409\update.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0409\update.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0409\
1⤵
PID:2500

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\
1⤵
PID:1616
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:3044
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:1676
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1600

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\
1⤵
PID:2792

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\
1⤵
PID:2400

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\
1⤵
PID:1132
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\
  2⤵
  PID:2728

C:\Windows\inf\ServiceModelService 3.0.0.0\0000\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0000\
1⤵
PID:1440

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:1668

C:\Windows\inf\ServiceModelService 3.0.0.0\0411\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0411\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0411\
1⤵
PID:2968

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:1164

C:\Windows\inf\SMSvcHost 3.0.0.0\040C\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\040C\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\040C\
1⤵
PID:1152

C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\
1⤵
PID:2560

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\
1⤵
PID:1396

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1596

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\
1⤵
PID:1668

C:\Windows\inf\SMSvcHost 4.0.0.0\0008\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0008\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0008\
1⤵
PID:1384

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\
1⤵
PID:920

C:\Windows\inf\SMSvcHost 4.0.0.0\0011\System Restore.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0011\System Restore.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0011\
1⤵
PID:3036

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\
1⤵
PID:2984

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\
1⤵
PID:1788

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\
1⤵
PID:892
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1536

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\
1⤵
PID:2004

C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0404\
1⤵
PID:2340

C:\Windows\inf\SMSvcHost 4.0.0.0\0416\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0416\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0416\
1⤵
PID:2748

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\
1⤵
PID:2808

C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0804\
1⤵
PID:2504

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\
1⤵
PID:2860

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2220

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2840

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\
1⤵
PID:2712

C:\Windows\inf\TAPISRV\0000\backup.exe
C:\Windows\inf\TAPISRV\0000\backup.exe C:\Windows\inf\TAPISRV\0000\
1⤵
PID:1800

C:\Windows\inf\TermService\0000\backup.exe
C:\Windows\inf\TermService\0000\backup.exe C:\Windows\inf\TermService\0000\
1⤵
PID:2952

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\
1⤵
PID:2252

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\
1⤵
PID:1644

C:\Windows\inf\TermService\0407\backup.exe
C:\Windows\inf\TermService\0407\backup.exe C:\Windows\inf\TermService\0407\
1⤵
PID:1792

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\
1⤵
PID:2776

C:\Windows\inf\TermService\0410\backup.exe
C:\Windows\inf\TermService\0410\backup.exe C:\Windows\inf\TermService\0410\
1⤵
PID:2720

C:\Windows\inf\TermService\0411\System Restore.exe
"C:\Windows\inf\TermService\0411\System Restore.exe" C:\Windows\inf\TermService\0411\
1⤵
PID:2732

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\
1⤵
PID:2592

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\
1⤵
PID:1732

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\
1⤵
PID:2496

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1780

C:\Windows\inf\UGatherer\0000\System Restore.exe
"C:\Windows\inf\UGatherer\0000\System Restore.exe" C:\Windows\inf\UGatherer\0000\
1⤵
PID:992

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\
1⤵
PID:2028

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3012

C:\Windows\inf\UGatherer\040C\backup.exe
C:\Windows\inf\UGatherer\040C\backup.exe C:\Windows\inf\UGatherer\040C\
1⤵
PID:2644

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\
1⤵
PID:2284

C:\Windows\inf\UGTHRSVC\0407\backup.exe
C:\Windows\inf\UGTHRSVC\0407\backup.exe C:\Windows\inf\UGTHRSVC\0407\
1⤵
PID:1440

C:\Windows\inf\UGTHRSVC\0409\data.exe
C:\Windows\inf\UGTHRSVC\0409\data.exe C:\Windows\inf\UGTHRSVC\0409\
1⤵
PID:2776

C:\Windows\inf\UGTHRSVC\0410\backup.exe
C:\Windows\inf\UGTHRSVC\0410\backup.exe C:\Windows\inf\UGTHRSVC\0410\
1⤵
PID:1536

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2488

C:\Windows\inf\usbhub\0000\backup.exe
C:\Windows\inf\usbhub\0000\backup.exe C:\Windows\inf\usbhub\0000\
1⤵
PID:1532

C:\Windows\inf\usbhub\0407\backup.exe
C:\Windows\inf\usbhub\0407\backup.exe C:\Windows\inf\usbhub\0407\
1⤵
PID:2380

C:\Windows\inf\usbhub\0C0A\backup.exe
C:\Windows\inf\usbhub\0C0A\backup.exe C:\Windows\inf\usbhub\0C0A\
1⤵
PID:2888

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\
1⤵
PID:2948

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2532

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\
1⤵
PID:2988

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\9fa0c0ee9093a5f1aaabffb101332056\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\9fa0c0ee9093a5f1aaabffb101332056\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\9fa0c0ee9093a5f1aaabffb101332056\
1⤵
PID:1604

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1300

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\
1⤵
PID:2944

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\
1⤵
PID:2752

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1316

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\
1⤵
PID:2292

C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\
1⤵
PID:1964
- C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2188

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\
1⤵
PID:952

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\
1⤵
PID:2080

C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\
1⤵
PID:3032

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\
1⤵
PID:1496

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\
1⤵
PID:1432
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\update.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\
  2⤵
  PID:1012
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\de64901e4cd2074f5c70733ab5d7787a\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\de64901e4cd2074f5c70733ab5d7787a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\de64901e4cd2074f5c70733ab5d7787a\
  2⤵
  PID:3012
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\
  2⤵
  PID:768

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000B\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000B\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000B\
1⤵
PID:2180

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2648

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2660

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\data.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\data.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\
1⤵
PID:1628

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0019\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0019\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0019\
1⤵
PID:548

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\
1⤵
PID:2464
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\
  2⤵
  PID:2244

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_de_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_de_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2168

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0404\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0404\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0404\
1⤵
PID:2364

C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\
1⤵
PID:2856

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\
1⤵
PID:1496

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2920

C:\Windows\inf\WmiApRpl\0009\backup.exe
C:\Windows\inf\WmiApRpl\0009\backup.exe C:\Windows\inf\WmiApRpl\0009\
1⤵
PID:2716

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\
1⤵
PID:1316
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2144
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:2888
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2372

C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\
1⤵
PID:2744

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\
1⤵
PID:1920
- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\
  2⤵
  PID:2324

C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\
1⤵
PID:1372
- C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\
  2⤵
  PID:2636

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\
1⤵
PID:3028

C:\Windows\ja-JP\backup.exe
C:\Windows\ja-JP\backup.exe C:\Windows\ja-JP\
1⤵
PID:2852

C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\f64692e58aa1a7116024bf3c3cbd1352\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\f64692e58aa1a7116024bf3c3cbd1352\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\f64692e58aa1a7116024bf3c3cbd1352\
1⤵
PID:2316

C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\
1⤵
PID:2884

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2660

C:\Windows\Logs\DPX\backup.exe
C:\Windows\Logs\DPX\backup.exe C:\Windows\Logs\DPX\
1⤵
PID:2084

C:\Windows\Logs\HomeGroup\backup.exe
C:\Windows\Logs\HomeGroup\backup.exe C:\Windows\Logs\HomeGroup\
1⤵
PID:2292

C:\Windows\Media\Calligraphy\backup.exe
C:\Windows\Media\Calligraphy\backup.exe C:\Windows\Media\Calligraphy\
1⤵
PID:2144

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\
1⤵
PID:2416

C:\Windows\Media\Characters\backup.exe
C:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2856

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1744

C:\Windows\Media\Quirky\data.exe
C:\Windows\Media\Quirky\data.exe C:\Windows\Media\Quirky\
1⤵
PID:1848

C:\Windows\Media\Savanna\backup.exe
C:\Windows\Media\Savanna\backup.exe C:\Windows\Media\Savanna\
1⤵
PID:2008

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\
1⤵
PID:3036

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2984

C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\
1⤵
PID:2228

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:1864

C:\Windows\Microsoft.NET\assembly\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\System Restore.exe" C:\Windows\Microsoft.NET\assembly\
1⤵
PID:2172

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1644

C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\
1⤵
PID:2484

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\
1⤵
PID:2296

C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1832

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1556

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2680

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2040

C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\
1⤵
PID:2260

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2784

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1472

C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\
1⤵
PID:2072

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\
1⤵
PID:2196
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\data.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\
  2⤵
  PID:2272

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1764

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2476

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\
1⤵
PID:2228

C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\
1⤵
PID:2852

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2928

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\
1⤵
PID:2460

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\
1⤵
PID:1984

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\
1⤵
PID:936

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1328

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2960

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\
1⤵
PID:1156

C:\Windows\assembly\GAC_MSIL\MMCEx\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx\
1⤵
PID:1804

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2720

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\
1⤵
PID:868
- C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2980

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\
1⤵
PID:1012

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\
1⤵
PID:1728
- C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:892

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\
1⤵
PID:2836

C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2332

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\
1⤵
PID:2388

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a933cd1241698e4d13d80c8cb31d7055\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a933cd1241698e4d13d80c8cb31d7055\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a933cd1241698e4d13d80c8cb31d7055\
1⤵
PID:1132

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\
1⤵
PID:2272

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\
1⤵
PID:576

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2404

C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\
1⤵
PID:2004
- C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:964

C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\
1⤵
PID:1832

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\
1⤵
PID:1744

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1940

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\
1⤵
PID:1532

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\
1⤵
PID:2400
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\
  2⤵
  PID:2604

C:\Windows\assembly\GAC_MSIL\napsnap\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap\
1⤵
PID:2156
- C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2444

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2848

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\
1⤵
PID:704

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\
1⤵
PID:2840

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\
1⤵
PID:1724

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\
1⤵
PID:984

C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1688

C:\Windows\assembly\GAC_MSIL\office\backup.exe
C:\Windows\assembly\GAC_MSIL\office\backup.exe C:\Windows\assembly\GAC_MSIL\office\
1⤵
PID:1520
- C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\update.exe
  C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\update.exe C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2412

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4436815b432c313255af322f4ec3560d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4436815b432c313255af322f4ec3560d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4436815b432c313255af322f4ec3560d\
1⤵
PID:2564

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\
1⤵
PID:2008

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\
1⤵
PID:2208
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1796

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\
1⤵
PID:2556

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1252

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\
1⤵
PID:2988

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1860

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\
1⤵
PID:3024
- C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\data.exe
  C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2316

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\
1⤵
PID:2692

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:832

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\
1⤵
PID:1664

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2952

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:2976

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\4a984a9ad59d14063bc6ae64a0c8f62a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\4a984a9ad59d14063bc6ae64a0c8f62a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\4a984a9ad59d14063bc6ae64a0c8f62a\
1⤵
PID:936

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\
1⤵
PID:2476
- C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2244

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\
1⤵
PID:2872
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\d9a485330ec2708456134e4a9712a4ab\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\d9a485330ec2708456134e4a9712a4ab\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\d9a485330ec2708456134e4a9712a4ab\
  2⤵
  PID:1644

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2916

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\
1⤵
PID:2272
- C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1616

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\
1⤵
PID:2416

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1632

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\
1⤵
PID:2176
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:568

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\
1⤵
PID:1140
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\4782a5d2bc7d86895faf404a3470aacb\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\4782a5d2bc7d86895faf404a3470aacb\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\4782a5d2bc7d86895faf404a3470aacb\
  2⤵
  PID:584

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2968

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\
1⤵
PID:772

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1556

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\
1⤵
PID:2088

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2040

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\
1⤵
PID:992

C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\
1⤵
PID:1424

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ec2acb1a563ecfce8396babd4a3b25\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ec2acb1a563ecfce8396babd4a3b25\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ec2acb1a563ecfce8396babd4a3b25\
1⤵
PID:2244

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2748

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\data.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2444

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\
1⤵
PID:2856
- C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2096

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\
1⤵
PID:2124
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\
  2⤵
  PID:1496

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Win32.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Win32.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Win32.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3028

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2180

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\
1⤵
PID:1540

C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\
1⤵
PID:1040
- C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\
  2⤵
  PID:312
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\update.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\
    3⤵
    PID:1276
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\
  2⤵
  PID:2776
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\
  2⤵
  PID:904
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\b648e07269decc9d5a2d8aeba1d48cbb\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\b648e07269decc9d5a2d8aeba1d48cbb\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\b648e07269decc9d5a2d8aeba1d48cbb\
    3⤵
    PID:1012
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\
  2⤵
  PID:2028
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\
  2⤵
  PID:3016
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\data.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\
    3⤵
    PID:2072
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\
  2⤵
  PID:3064

C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\
1⤵
PID:1560

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\
1⤵
PID:3012

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\
1⤵
PID:1636
- C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1580

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\
1⤵
PID:1788

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\update.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\update.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1596

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\
1⤵
PID:2472

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\
1⤵
PID:2144
- C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1536

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\
1⤵
PID:2096

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1496

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\update.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\update.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\
1⤵
PID:1688

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2580

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:1804

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1160

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\
1⤵
PID:2196

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\
1⤵
PID:612

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\
1⤵
PID:1204

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\99c61751c71078d92ff372495bc38fc3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\99c61751c71078d92ff372495bc38fc3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\99c61751c71078d92ff372495bc38fc3\
1⤵
PID:1820

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2892

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\
1⤵
PID:1332

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\
1⤵
PID:2044

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\
1⤵
PID:2292

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:1432

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\
1⤵
PID:2280

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\
1⤵
PID:1580

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\
1⤵
PID:2776
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\
  2⤵
  PID:772

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\
1⤵
PID:2184
- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\
  2⤵
  PID:2792

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\
1⤵
PID:1500

C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\
1⤵
PID:2584

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\
1⤵
PID:2164

C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\data.exe
C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\data.exe C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\
1⤵
PID:1608

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\data.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2616

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\
1⤵
PID:2044

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\
1⤵
PID:2984

C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2912

C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2556

C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2968

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\
1⤵
PID:1256

C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\
1⤵
PID:268

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\
1⤵
PID:2664

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\
1⤵
PID:2560

C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\
1⤵
PID:2584

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\
1⤵
PID:2084

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
adbacd38669a2e383bc11570b5795af8

SHA1
1504cf38cd16e1db4f3b4b4936c6a43d56a4981b

SHA256
0ab673d164c9014b46b360ede0d86351f9a802e507ce3c4d446563f14ea9e1d1

SHA512
460411b307a97965464f0cd2ce8a0763ae5c1e7a101c45b648c3a2252b75ad5602908adeba0d9133d038de9e60fd97add8fce1d8b3b5494a503e146957ab9245

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
d4157ecc50090ccad38358c8aa71f5d0

SHA1
e3ece6279032a3ec1af2aa7eb1cc08aabfdc582d

SHA256
6f6e57f425d165999dcf1a56211810da19cd63206be5069ef2e2dc3dfd6b3f41

SHA512
d94512caa9369ce4874f4ff26b992b98aeb201a5552f033322abc0c22ac4173252a1c1f33096003b2100aa116b48f451f1868356f3068ce9704faa08c947d4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1642330836\backup.exe

Filesize
72KB

MD5
264b6ca06d2abc644bd702c0f31170bc

SHA1
6075457de454bf99471894c20ab94e0823547393

SHA256
f47e7499e95edfcf91ba2d13379486ad716312d3a2dce1c097d54af735b0d96e

SHA512
a486f23d221a69da1e9dfd9ff7ce3dcff9be3e6d7f417c3c288dd955b0670718e7000dcaac48ab778de5d46b544524756161558a1c9238782588c1e394de32f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
71eb5b73699a63151ff2384d2a06b982

SHA1
01339e7dc2accb9ad6be5b8921b64cf22de50130

SHA256
430ffce16b4ec3a2e96bdd683d18c16e6fc6f7e8cda06f6bc53f6e8761ea4ad6

SHA512
0921c249b9f24ab45717862707b9fd7f4050464994d19b2de7e056ab8051003b170890839c36465e8959af2f122e2e92176f5d20e5d3159fbfb97b097ce74b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\data.exe

Filesize
72KB

MD5
29a739d05a569c9de0a018112292094f

SHA1
84eac830fc8b98ca99748d4d14bb0e6f5c86a59c

SHA256
c91eccce0cccbda1d7a8c4d65767e885a7af7ecc351337b31bbdf75f9cd62e86

SHA512
a0449984c34255de82486de79a040a43c3771a65ae72a6e91d1252f407e94e0f43ccd1e09a19338d99d93570d103ed04bc93a63bb7365c1ae5a049c77ceed488

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
2dc977d08c903e353ba089b10f48b48b

SHA1
0298627f78d26a3953b008452cd96ce8e1a267b2

SHA256
fc522f07ea862c120477e51635eba555567fd6b9d5893d297ac212935a5922e5

SHA512
8143c50ff20d5eed57fd85841d2207570a181b785f6fdd4829c28592625189ea4b3f8dcf55cfa5dde9c9fa6d20cb34786a342fc75fff27f8f5749010ee6beaa8

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
c828e9751df64a94d3fa8dd7978317b1

SHA1
4ac601bf6d6e203c42782147fbec73c5724c06a5

SHA256
88a93957870805f12d81bdb9b6ad1742243a8627b142f6540f466c57b447cc1d

SHA512
c98c14df550b815544b9640ad1f25bc674f298e9b38c25949b8c244029b20694c167d513d36a5ded44865180fc3ea2f8bb27298e634438e52450e5acddf433d6

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\data.exe

Filesize
72KB

MD5
348221a2970160395348322a9e188581

SHA1
e01198f9b2e20c6627640d3863778fd90d62ae31

SHA256
58b4090d6bd2f90da686b17dac975b5c73bec3924bcaad5d1e9ea24ba1ad05e8

SHA512
743ce6476c7244996cac6a155b5db5ccc246cf3463da9887014acc9d7e321f9eabfc31cc7d9a5b33e25b02c9aad3b4d1c695cb8c0de50baaf2d58f6fcc659510

Download Submit
memory/696-19129-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/880-5699-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/904-5223-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/992-12216-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1276-11938-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1360-19263-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1384-18611-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2024-17889-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2216-17845-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2284-13805-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2404-15632-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2588-19310-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2596-8885-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2596-11114-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/2972-16639-0x0000000077720000-0x000000007783F000-memory.dmp

Filesize
1.1MB

Download
memory/2972-4781-0x0000000077840000-0x000000007793A000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads