4194d7243e08a8ad79cf7dad229bfee1363ebdad2c19f685412a7590474c360e

Analysis

max time kernel
82s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4194d7243e08a8ad79cf7dad229bfee1363ebdad2c19f685412a7590474c360e.exe
Size

72KB
MD5

db4aaa6bb3cb6ec6f4682294bd1dd636
SHA1

f9081aa851f22cac3cb485aba81b0b1ae93acef8
SHA256

4194d7243e08a8ad79cf7dad229bfee1363ebdad2c19f685412a7590474c360e
SHA512

d6ccd2aef63ff01cd9c0e55c55a05a536387234748d23b16a7a4ec73930acfd1278d1b2206a7f1e03fbd0b6f141db56cbcb435205ecb874e2046c17e2d76e616
SSDEEP

384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2I:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrE

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\4194d7243e08a8ad79cf7dad229bfee1363ebdad2c19f685412a7590474c360e.exe
"C:\Users\Admin\AppData\Local\Temp\4194d7243e08a8ad79cf7dad229bfee1363ebdad2c19f685412a7590474c360e.exe"
1⤵
PID:2396
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2952

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\
1⤵
PID:2788

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
1⤵
PID:1888
- C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
  2⤵
  PID:1960
- C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
  2⤵
  PID:1636
- C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:868
- C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
  2⤵
  PID:1328
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:792
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
  2⤵
  PID:892
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
    3⤵
    PID:2036
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
    3⤵
    PID:2468
- C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
  2⤵
  PID:2516
- C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
  2⤵
  PID:2700
- C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
  2⤵
  PID:2808
- C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
  2⤵
  PID:1972
- C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
  2⤵
  PID:1876
- C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
  2⤵
  PID:1552
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
  2⤵
  PID:1444
- C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
  2⤵
  PID:2892
- C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
  2⤵
  PID:1568
- C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
  2⤵
  PID:604
- C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
  2⤵
  PID:2436
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
  2⤵
  PID:1792

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:1728
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:2072
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
  2⤵
  PID:2300
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:1152

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2940

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:2656

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:2588

C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
1⤵
PID:2528

C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
1⤵
PID:2596

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2764
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:2744
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2824

C:\Program Files\Common Files\Microsoft Shared\VGX\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:1652

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:1356

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
1⤵
PID:2320

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:2716
- C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
  2⤵
  PID:1072
- C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
  2⤵
  PID:2336

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:2208
- C:\Program Files\Common Files\System\msadc\fr-FR\update.exe
  "C:\Program Files\Common Files\System\msadc\fr-FR\update.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
  2⤵
  PID:2752
- C:\Program Files\Common Files\System\msadc\ja-JP\update.exe
  "C:\Program Files\Common Files\System\msadc\ja-JP\update.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
  2⤵
  PID:2724

C:\Program Files\Common Files\System\Ole DB\backup.exe
"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
1⤵
PID:2872
- C:\Program Files\Common Files\System\Ole DB\en-US\update.exe
  "C:\Program Files\Common Files\System\Ole DB\en-US\update.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
  2⤵
  PID:2100

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:2504

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
1⤵
PID:1740
- C:\Program Files\DVD Maker\Shared\DvdStyles\Full\update.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
  2⤵
  PID:1964
- C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
  2⤵
  PID:2832
- C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
  2⤵
  PID:1812
- C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
  2⤵
  PID:1072
- C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\System Restore.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
  2⤵
  PID:1976
- C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
  2⤵
  PID:972
- C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
  2⤵
  PID:568

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:924
- C:\Program Files\Google\Chrome\backup.exe
  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
  2⤵
  PID:2192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
1⤵
PID:2756

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
1⤵
PID:2488

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:2984

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:556

C:\Program Files\Java\jdk1.7.0_80\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
1⤵
PID:1444
- C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
  2⤵
  PID:1760
- - C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
    3⤵
    PID:2896
- C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
  2⤵
  PID:2256

C:\Program Files\Java\jdk1.7.0_80\jre\bin\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:844
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
  2⤵
  PID:1688

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
1⤵
PID:780
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
  2⤵
  PID:2764
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
  2⤵
  PID:2188
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
  2⤵
  PID:2228
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
  2⤵
  PID:2684

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
1⤵
PID:2144

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
1⤵
PID:2720

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
1⤵
PID:2480

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
1⤵
PID:536

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:2852

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
1⤵
PID:2696

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
1⤵
PID:2836

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
1⤵
PID:1580

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:772

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:268
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
  2⤵
  PID:684
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:1044
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:1064
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
  2⤵
  PID:1976
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:1624
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1716
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
  2⤵
  PID:2540
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:2792
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:2840
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:2948

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
1⤵
PID:2064

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
1⤵
PID:848

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2216

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
1⤵
PID:1132

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:596

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:1536

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
1⤵
PID:764

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
1⤵
PID:592

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
1⤵
PID:916

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
1⤵
PID:1068
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
  2⤵
  PID:2160

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
1⤵
PID:1952

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
1⤵
PID:3024
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
  2⤵
  PID:2708

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:2756

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:2460

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
1⤵
PID:2528
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
  2⤵
  PID:2676

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:2616

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
1⤵
PID:536

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:2696

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:2504

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
1⤵
PID:2280

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:1320

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
1⤵
PID:696

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
1⤵
PID:1084

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:1576
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
  2⤵
  PID:348

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:1788

C:\Program Files\Java\jre7\bin\update.exe
"C:\Program Files\Java\jre7\bin\update.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:304
- C:\Program Files\Java\jre7\bin\plugin2\backup.exe
  "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
  2⤵
  PID:1408

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:2568

C:\Program Files\Java\jre7\lib\cmm\backup.exe
"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
1⤵
PID:1300

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:2636

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
1⤵
PID:2676

C:\Program Files\Java\jre7\lib\management\backup.exe
"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
1⤵
PID:2616

C:\Program Files\Java\jre7\lib\zi\backup.exe
"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
1⤵
PID:536
- C:\Program Files\Java\jre7\lib\zi\America\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
  2⤵
  PID:1972
- - C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
    3⤵
    PID:1580
- C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
  2⤵
  PID:2308
- C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
  2⤵
  PID:2804
- C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
  2⤵
  PID:2052
- C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
  2⤵
  PID:624
- C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
  2⤵
  PID:2432

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:2436
- C:\Program Files\Microsoft Games\Hearts\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
  2⤵
  PID:304
- - C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
    3⤵
    PID:2648
- - C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
    3⤵
    PID:2536
- C:\Program Files\Microsoft Games\Mahjong\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
  2⤵
  PID:1060
- - C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
    3⤵
    PID:1204
- C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
  2⤵
  PID:2040
- - C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
    3⤵
    PID:2116
- - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\data.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\data.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
    3⤵
    PID:2444

C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
1⤵
PID:844

C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
1⤵
PID:1636

C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
1⤵
PID:972

C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
1⤵
PID:2764

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
1⤵
PID:2188

C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
1⤵
PID:1132

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
1⤵
PID:2612

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:2344

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:2784

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
1⤵
PID:2040

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:2112

C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
1⤵
PID:1960

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2272

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
1⤵
PID:1848

C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
1⤵
PID:1744

C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
1⤵
PID:1444

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
1⤵
PID:2216

C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
1⤵
PID:2612
- C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
  2⤵
  PID:2876
- C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
  2⤵
  PID:2648
- C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
  2⤵
  PID:2536

C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
1⤵
PID:2600

C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
1⤵
PID:2792

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
1⤵
PID:1768

C:\Program Files\Mozilla Firefox\browser\features\backup.exe
"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
1⤵
PID:1788

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:1880

C:\Program Files\Mozilla Firefox\uninstall\backup.exe
"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
1⤵
PID:1276

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:2760

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
1⤵
PID:2648

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
1⤵
PID:2744

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:1580

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
1⤵
PID:2680

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
1⤵
PID:356

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
1⤵
PID:2360

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
1⤵
PID:2656

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:2980
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:992
- C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
  2⤵
  PID:2128
- C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
  2⤵
  PID:2828
- C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
  2⤵
  PID:1340
- C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
  2⤵
  PID:1468
- C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
  2⤵
  PID:2916
- C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
  2⤵
  PID:2772
- C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
  2⤵
  PID:1788
- C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
  2⤵
  PID:1952
- C:\Program Files\VideoLAN\VLC\locale\ps\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
  2⤵
  PID:2508
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
  2⤵
  PID:924
- C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
  2⤵
  PID:1876
- C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
  2⤵
  PID:1672
- C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
  2⤵
  PID:2728

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
1⤵
PID:2676

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
1⤵
PID:2820

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
1⤵
PID:1876

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
1⤵
PID:2024

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
1⤵
PID:2112

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
1⤵
PID:1976

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:2020

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
1⤵
PID:2056

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
1⤵
PID:2844

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
1⤵
PID:640

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
1⤵
PID:2480

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2096

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
1⤵
PID:2052

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\update.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:1080

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
1⤵
PID:696

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:1280
- C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
  2⤵
  PID:1092
- C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
  2⤵
  PID:2656
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
  2⤵
  PID:1032
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
  2⤵
  PID:2500
- C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
  2⤵
  PID:2696

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
1⤵
PID:2968

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
1⤵
PID:1808

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
1⤵
PID:924

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
1⤵
PID:1088

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:2448

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
1⤵
PID:648

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
1⤵
PID:1848

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:1996

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:1824

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
1⤵
PID:2688

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:2968

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
1⤵
PID:2032

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
1⤵
PID:1080

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
1⤵
PID:2316

C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
1⤵
PID:1444

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
1⤵
PID:2580

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
1⤵
PID:2208

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
1⤵
PID:2060

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
1⤵
PID:2872

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
1⤵
PID:1068

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:916

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:1172

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:1040

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
1⤵
PID:1072

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
1⤵
PID:2188

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
1⤵
PID:1756

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
1⤵
PID:2304

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:624

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:1688

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:1836

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
1⤵
PID:1636

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
1⤵
PID:2620

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
1⤵
PID:1256

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
1⤵
PID:2648

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
1⤵
PID:2740

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
1⤵
PID:2628

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
1⤵
PID:2516

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
1⤵
PID:1892

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
1⤵
PID:2484

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
1⤵
PID:2252

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:1976

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
1⤵
PID:1400

C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
1⤵
PID:1892

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:2832

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:1804

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\
1⤵
PID:2580

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\
1⤵
PID:2484

C:\Program Files (x86)\Common Files\Services\System Restore.exe
"C:\Program Files (x86)\Common Files\Services\System Restore.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:2720

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
1⤵
PID:2396

C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
1⤵
PID:2644

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:2724

C:\Program Files (x86)\Common Files\System\ado\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
1⤵
PID:2040
- C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
  2⤵
  PID:2824
- C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
  2⤵
  PID:2608
- C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe
  "C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
  2⤵
  PID:2564

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
1⤵
PID:1676
- C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
  2⤵
  PID:556

C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
1⤵
PID:1560

C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
1⤵
PID:2408

C:\Program Files\VideoLAN\VLC\lua\intf\data.exe
"C:\Program Files\VideoLAN\VLC\lua\intf\data.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
1⤵
PID:3000

C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
1⤵
PID:2656
- C:\Program Files\VideoLAN\VLC\lua\meta\reader\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\lua\meta\reader\System Restore.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
  2⤵
  PID:2480

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
1⤵
PID:1672

C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
1⤵
PID:2688

C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
1⤵
PID:328

C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
1⤵
PID:1724

C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
1⤵
PID:1632

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe
"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\
1⤵
PID:2096

C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
1⤵
PID:2540

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\
1⤵
PID:600
- C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
  2⤵
  PID:772

C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\demux\
1⤵
PID:1848

C:\Program Files (x86)\Google\Update\backup.exe
"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
1⤵
PID:2580
- C:\Program Files (x86)\Google\Update\Offline\backup.exe
  "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
  2⤵
  PID:2452

C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
1⤵
PID:2888

C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:1700

C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\spu\
1⤵
PID:2264

C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\backup.exe
"C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\
1⤵
PID:2336

C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_filter\
1⤵
PID:2788

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
1⤵
PID:2396

C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
1⤵
PID:352

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
1⤵
PID:1064

C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\visualization\
1⤵
PID:1800

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
1⤵
PID:696

C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
1⤵
PID:1976

C:\Program Files\Windows Defender\en-US\backup.exe
"C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
1⤵
PID:2672

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\update.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\update.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
1⤵
PID:1960
- C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\
  2⤵
  PID:408

C:\Program Files\Windows Defender\fr-FR\backup.exe
"C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
1⤵
PID:476

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:2660
- C:\Program Files\Windows Journal\de-DE\backup.exe
  "C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:2216
- C:\Program Files\Windows Journal\en-US\backup.exe
  "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
  2⤵
  PID:2192

C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\
1⤵
PID:2488
- C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe
  "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
  2⤵
  PID:2384

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\
1⤵
PID:1280

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\
1⤵
PID:3048

C:\Program Files\Windows Mail\fr-FR\backup.exe
"C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
1⤵
PID:1140

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
1⤵
PID:576

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:1592

C:\Program Files\Windows Media Player\es-ES\backup.exe
"C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
1⤵
PID:2752

C:\Program Files\Windows Media Player\fr-FR\backup.exe
"C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:2248

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\
1⤵
PID:2556

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\
1⤵
PID:2492

C:\Program Files\Windows Media Player\ja-JP\backup.exe
"C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
1⤵
PID:2664

C:\Program Files\Windows Media Player\Visualizations\backup.exe
"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\
1⤵
PID:1756

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\
1⤵
PID:2788

C:\Program Files\Windows NT\Accessories\de-DE\backup.exe
"C:\Program Files\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files\Windows NT\Accessories\de-DE\
1⤵
PID:1144

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\
1⤵
PID:2980

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
1⤵
PID:2776

C:\Program Files\Windows NT\TableTextService\en-US\update.exe
"C:\Program Files\Windows NT\TableTextService\en-US\update.exe" C:\Program Files\Windows NT\TableTextService\en-US\
1⤵
PID:2068

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\
1⤵
PID:2916

C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe
"C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe" C:\Program Files\Windows NT\TableTextService\it-IT\
1⤵
PID:2028

C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\
1⤵
PID:1300

C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\3082\
1⤵
PID:2532

C:\Program Files\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files\Windows Photo Viewer\de-DE\
1⤵
PID:356

C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\
1⤵
PID:2300

C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe
"C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files\Windows Photo Viewer\fr-FR\
1⤵
PID:2216

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\
1⤵
PID:2592

C:\Program Files\Windows Sidebar\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\de-DE\backup.exe" C:\Program Files\Windows Sidebar\de-DE\
1⤵
PID:2584

C:\Program Files\Windows Sidebar\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\es-ES\backup.exe" C:\Program Files\Windows Sidebar\es-ES\
1⤵
PID:1652

C:\Program Files\Windows Sidebar\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\fr-FR\
1⤵
PID:1640

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\
1⤵
PID:1688

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\
1⤵
PID:2120

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\
1⤵
PID:2556

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
1⤵
PID:1624

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\
1⤵
PID:1088
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\
  2⤵
  PID:1816
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\data.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\update.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\
    3⤵
    PID:2560

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:1464

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
1⤵
PID:2692

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\
1⤵
PID:764

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\
1⤵
PID:696
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
  2⤵
  PID:1400

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\
1⤵
PID:2136
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\
  2⤵
  PID:2056

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\
1⤵
PID:1292
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\
  2⤵
  PID:556

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\
1⤵
PID:2188

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
1⤵
PID:2708

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
1⤵
PID:2748

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\
1⤵
PID:2080

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
1⤵
PID:2284

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1108

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\
1⤵
PID:2244
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\
  2⤵
  PID:2588

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
1⤵
PID:1424

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\update.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\
1⤵
PID:2012

C:\Users\Admin\Contacts\backup.exe
C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
1⤵
PID:2028

C:\Users\Admin\Downloads\backup.exe
C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
1⤵
PID:2844

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
1⤵
PID:2740

C:\Users\Admin\Links\backup.exe
C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
1⤵
PID:816

C:\Users\Admin\Music\System Restore.exe
"C:\Users\Admin\Music\System Restore.exe" C:\Users\Admin\Music\
1⤵
PID:2760

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\
1⤵
PID:1264

C:\Users\Public\Music\update.exe
C:\Users\Public\Music\update.exe C:\Users\Public\Music\
1⤵
PID:1836
- C:\Users\Public\Music\Sample Music\backup.exe
  "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
  2⤵
  PID:3000

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\
1⤵
PID:2476

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:2136

C:\Users\Public\Recorded TV\Sample Media\data.exe
"C:\Users\Public\Recorded TV\Sample Media\data.exe" C:\Users\Public\Recorded TV\Sample Media\
1⤵
PID:2940

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\
1⤵
PID:2260

C:\Users\Public\Videos\Sample Videos\backup.exe
"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
1⤵
PID:2156

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\
1⤵
PID:1944
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\
  2⤵
  PID:2080

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
1⤵
PID:2884

C:\Windows\AppPatch\backup.exe
C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
1⤵
PID:784
- C:\Windows\AppPatch\Custom\backup.exe
  C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
  2⤵
  PID:1172
- - C:\Windows\AppPatch\Custom\Custom64\backup.exe
    C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\
    3⤵
    PID:696
- C:\Windows\AppPatch\ja-JP\backup.exe
  C:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\
  2⤵
  PID:2888

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\
1⤵
PID:2672

C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\
1⤵
PID:1888

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\
1⤵
PID:2620

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\
1⤵
PID:2160

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\
1⤵
PID:816

C:\Windows\assembly\GAC\backup.exe
C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
1⤵
PID:2156

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2628

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:1816
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\
  2⤵
  PID:2468

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\
1⤵
PID:2084

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\
1⤵
PID:576

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
1⤵
PID:1608

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\
1⤵
PID:2528

C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\
1⤵
PID:2260

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
1⤵
PID:2240

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:2648

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:816

C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\
1⤵
PID:2516

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
1⤵
PID:2444

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2396

C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe
"C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\
1⤵
PID:2080

C:\Program Files (x86)\Microsoft Office\Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\
1⤵
PID:2256
- C:\Program Files (x86)\Microsoft Office\Templates\1033\data.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\data.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\
  2⤵
  PID:2776
- - C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\
    3⤵
    PID:2980
  - - C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe
      "C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\
      4⤵
      PID:1300

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2556

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
1⤵
PID:3048

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
1⤵
PID:892
- C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2264

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\
1⤵
PID:2648

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2700

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\
1⤵
PID:2192

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
1⤵
PID:2744

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:2156

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1944

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\
1⤵
PID:2444

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\
1⤵
PID:2124
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:1340
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:568
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:1820

C:\Program Files (x86)\Microsoft Sync Framework\data.exe
"C:\Program Files (x86)\Microsoft Sync Framework\data.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:852
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:1400
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\
    3⤵
    PID:1888
  - - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe
      "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\
      4⤵
      PID:1668
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\
    3⤵
    PID:3036

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\data.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\
1⤵
PID:1896
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
  2⤵
  PID:2824

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\
1⤵
PID:992

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\
1⤵
PID:2236
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\update.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
  2⤵
  PID:2260

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:1444
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1168

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\
1⤵
PID:924
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\
  2⤵
  PID:2612

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\
1⤵
PID:1084
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\System Restore.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\
  2⤵
  PID:2112

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:816

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:840
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
  2⤵
  PID:2964
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
  2⤵
  PID:2824

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\
1⤵
PID:2092
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\
  2⤵
  PID:2044
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\
    3⤵
    PID:1224
  - - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe
      "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\
      4⤵
      PID:792
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\
  2⤵
  PID:2052

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\update.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\update.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\
1⤵
PID:2444
- C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2040

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
1⤵
PID:992

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\
1⤵
PID:600
- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2624

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
1⤵
PID:2460

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\
1⤵
PID:2124

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\
1⤵
PID:2660

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
1⤵
PID:1992

C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\
1⤵
PID:1536

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:1772

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1748

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\
1⤵
PID:2020
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
  2⤵
  PID:1264

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\
1⤵
PID:2568

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\
1⤵
PID:560

C:\Program Files (x86)\Microsoft.NET\backup.exe
"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
1⤵
PID:2272
- C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
  2⤵
  PID:900

C:\Windows\assembly\GAC_32\MSBuild\update.exe
C:\Windows\assembly\GAC_32\MSBuild\update.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:1092

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\
1⤵
PID:2756
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
  2⤵
  PID:2980

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\
1⤵
PID:596
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\
  2⤵
  PID:1664
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
    3⤵
    PID:1984
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\
  2⤵
  PID:2460
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\
    3⤵
    PID:2784

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
1⤵
PID:2532

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:1836

C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\
1⤵
PID:2560

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2452

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:1608

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
1⤵
PID:2684

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:2972
- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2656

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\update.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\update.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
1⤵
PID:2708

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:2552

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
1⤵
PID:1628

C:\Windows\assembly\GAC_32\System.Data\backup.exe
C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:2052

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\
1⤵
PID:772

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\
1⤵
PID:2944

C:\Program Files\Windows Sidebar\Shared Gadgets\backup.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\backup.exe" C:\Program Files\Windows Sidebar\Shared Gadgets\
1⤵
PID:1312

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:2980

C:\Program Files (x86)\Windows Defender\en-US\backup.exe
"C:\Program Files (x86)\Windows Defender\en-US\backup.exe" C:\Program Files (x86)\Windows Defender\en-US\
1⤵
PID:3056

C:\Program Files (x86)\Windows Mail\backup.exe
"C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\
1⤵
PID:2356
- C:\Program Files (x86)\Windows Mail\en-US\backup.exe
  "C:\Program Files (x86)\Windows Mail\en-US\backup.exe" C:\Program Files (x86)\Windows Mail\en-US\
  2⤵
  PID:1872
- C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe" C:\Program Files (x86)\Windows Mail\fr-FR\
  2⤵
  PID:1532
- C:\Program Files (x86)\Windows Mail\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Mail\it-IT\backup.exe" C:\Program Files (x86)\Windows Mail\it-IT\
  2⤵
  PID:2504

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2628

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1088

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:1536

C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe
"C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe" C:\Program Files (x86)\Windows Media Player\it-IT\
1⤵
PID:2024

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:332

C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
"C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
1⤵
PID:2960

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2812

C:\Program Files (x86)\Windows NT\data.exe
"C:\Program Files (x86)\Windows NT\data.exe" C:\Program Files (x86)\Windows NT\
1⤵
PID:1808

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1652

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2808

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2320

C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\it-IT\
1⤵
PID:1104

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\
1⤵
PID:2848

C:\Program Files (x86)\Windows NT\TableTextService\it-IT\update.exe
"C:\Program Files (x86)\Windows NT\TableTextService\it-IT\update.exe" C:\Program Files (x86)\Windows NT\TableTextService\it-IT\
1⤵
PID:2492

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1724

C:\Program Files (x86)\Windows Photo Viewer\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\
1⤵
PID:1544
- C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\fr-FR\
  2⤵
  PID:648

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2596

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1736

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\
1⤵
PID:2948

C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
1⤵
PID:812

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2656

C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\es-ES\
1⤵
PID:1996

C:\Program Files (x86)\Windows Sidebar\Gadgets\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\
1⤵
PID:852

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
1⤵
PID:1400
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
  2⤵
  PID:2304

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
1⤵
PID:2892
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
  2⤵
  PID:1800

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\
1⤵
PID:1760

C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1592

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
1⤵
PID:1040

C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2596

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2980

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\
1⤵
PID:560

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
1⤵
PID:2424

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1652

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\
1⤵
PID:1900

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\
1⤵
PID:2700

C:\Windows\assembly\GAC_64\System.Printing\backup.exe
C:\Windows\assembly\GAC_64\System.Printing\backup.exe C:\Windows\assembly\GAC_64\System.Printing\
1⤵
PID:1740

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
1⤵
PID:1332

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\
1⤵
PID:1152

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:2984

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
1⤵
PID:2724

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
1⤵
PID:332

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:2564

C:\Windows\assembly\GAC_MSIL\dfsvc\data.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\data.exe C:\Windows\assembly\GAC_MSIL\dfsvc\
1⤵
PID:2720

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
1⤵
PID:2424

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:1044

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
1⤵
PID:1400

C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe C:\Windows\assembly\GAC_MSIL\ehiExtens\
1⤵
PID:1880

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
1⤵
PID:320

C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\
1⤵
PID:868

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
1⤵
PID:2020

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
1⤵
PID:2932

C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\
1⤵
PID:2556

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\
1⤵
PID:2532

C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\
1⤵
PID:2792

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\
1⤵
PID:968

C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\
1⤵
PID:2308
- C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2844

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
1⤵
PID:2092

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\
1⤵
PID:2540
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
  2⤵
  PID:1728
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\
  2⤵
  PID:1140

C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1568

C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2668

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\
1⤵
PID:2128

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\
1⤵
PID:2596
- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2452

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
1⤵
PID:2528

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1360

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
1⤵
PID:2972

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\
1⤵
PID:2600

C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\
1⤵
PID:2308

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:1532

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
1⤵
PID:1880

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
1⤵
PID:684

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\
1⤵
PID:604

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\
1⤵
PID:2012

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\
1⤵
PID:1548

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\
1⤵
PID:2800
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2612

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:1996

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\
1⤵
PID:968

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\
1⤵
PID:2840

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:3068

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1656

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
1⤵
PID:2444

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\
1⤵
PID:600

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1948

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\
1⤵
PID:2504
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
  2⤵
  PID:1728

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:1516

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:868

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\
1⤵
PID:2496
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
  2⤵
  PID:604

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1716

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
1⤵
PID:556

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2064

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\
1⤵
PID:600

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\
1⤵
PID:2448
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:1632

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\
1⤵
PID:2300

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\
1⤵
PID:1572

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\
1⤵
PID:840

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\
1⤵
PID:3032
- C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:2120

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\
1⤵
PID:2532
- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:1548

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1900

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1892

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\
1⤵
PID:892
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:1332
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1400
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:2040

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:1800
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2672

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1772

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1808

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\
1⤵
PID:1276

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\
1⤵
PID:3032

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\
1⤵
PID:476
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1108

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\
1⤵
PID:1168
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:556

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\
1⤵
PID:2240
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1704

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\
1⤵
PID:1548
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1068

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\
1⤵
PID:1104
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2320

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\
1⤵
PID:1044
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2532

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\
1⤵
PID:2336

C:\Windows\Branding\Basebrd\backup.exe
C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
1⤵
PID:1900
- C:\Windows\Branding\Basebrd\en-US\backup.exe
  C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
  2⤵
  PID:596

C:\Windows\Branding\ShellBrd\backup.exe
C:\Windows\Branding\ShellBrd\backup.exe C:\Windows\Branding\ShellBrd\
1⤵
PID:2380

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1080

C:\Windows\debug\backup.exe
C:\Windows\debug\backup.exe C:\Windows\debug\
1⤵
PID:340

C:\Windows\DigitalLocker\System Restore.exe
"C:\Windows\DigitalLocker\System Restore.exe" C:\Windows\DigitalLocker\
1⤵
PID:2444
- C:\Windows\DigitalLocker\en-US\backup.exe
  C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
  2⤵
  PID:476
- C:\Windows\DigitalLocker\fr-FR\backup.exe
  C:\Windows\DigitalLocker\fr-FR\backup.exe C:\Windows\DigitalLocker\fr-FR\
  2⤵
  PID:1956

C:\Windows\Downloaded Program Files\backup.exe
"C:\Windows\Downloaded Program Files\backup.exe" C:\Windows\Downloaded Program Files\
1⤵
PID:1256

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\
1⤵
PID:2804

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\
1⤵
PID:2304

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\
1⤵
PID:1172

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\
1⤵
PID:1768

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1176

C:\Windows\ehome\CreateDisc\Styles\PAL\backup.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\
1⤵
PID:648

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\
1⤵
PID:1276

C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\update.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\update.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\
1⤵
PID:2712

C:\Windows\ehome\en-US\backup.exe
C:\Windows\ehome\en-US\backup.exe C:\Windows\ehome\en-US\
1⤵
PID:2536

C:\Windows\ehome\it-IT\backup.exe
C:\Windows\ehome\it-IT\backup.exe C:\Windows\ehome\it-IT\
1⤵
PID:2256

C:\Windows\ehome\ja-JP\backup.exe
C:\Windows\ehome\ja-JP\backup.exe C:\Windows\ehome\ja-JP\
1⤵
PID:2580

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1104

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\
1⤵
PID:2384

C:\Windows\ehome\wow\de-DE\backup.exe
C:\Windows\ehome\wow\de-DE\backup.exe C:\Windows\ehome\wow\de-DE\
1⤵
PID:1364

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:1152

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\
1⤵
PID:1964

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\
1⤵
PID:2032

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\
1⤵
PID:2156

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:1704

C:\Windows\Help\Help\en-US\backup.exe
C:\Windows\Help\Help\en-US\backup.exe C:\Windows\Help\Help\en-US\
1⤵
PID:1104

C:\Windows\Help\mui\0407\backup.exe
C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
1⤵
PID:2024

C:\Windows\Help\mui\0409\backup.exe
C:\Windows\Help\mui\0409\backup.exe C:\Windows\Help\mui\0409\
1⤵
PID:2744

C:\Windows\Help\mui\0410\backup.exe
C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\
1⤵
PID:328

C:\Windows\Help\mui\0C0A\backup.exe
C:\Windows\Help\mui\0C0A\backup.exe C:\Windows\Help\mui\0C0A\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1768

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1668

C:\Windows\Help\Windows\backup.exe
C:\Windows\Help\Windows\backup.exe C:\Windows\Help\Windows\
1⤵
PID:2068
- C:\Windows\Help\Windows\es-ES\backup.exe
  C:\Windows\Help\Windows\es-ES\backup.exe C:\Windows\Help\Windows\es-ES\
  2⤵
  PID:2560
- C:\Windows\Help\Windows\it-IT\backup.exe
  C:\Windows\Help\Windows\it-IT\backup.exe C:\Windows\Help\Windows\it-IT\
  2⤵
  PID:2156

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2424

C:\Windows\IME\backup.exe
C:\Windows\IME\backup.exe C:\Windows\IME\
1⤵
PID:1500
- C:\Windows\IME\es-ES\backup.exe
  C:\Windows\IME\es-ES\backup.exe C:\Windows\IME\es-ES\
  2⤵
  PID:2508
- C:\Windows\IME\IMEJP10\backup.exe
  C:\Windows\IME\IMEJP10\backup.exe C:\Windows\IME\IMEJP10\
  2⤵
  PID:2176
- - C:\Windows\IME\IMEJP10\DICTS\backup.exe
    C:\Windows\IME\IMEJP10\DICTS\backup.exe C:\Windows\IME\IMEJP10\DICTS\
    3⤵
    PID:1340
- C:\Windows\IME\IMESC5\backup.exe
  C:\Windows\IME\IMESC5\backup.exe C:\Windows\IME\IMESC5\
  2⤵
  PID:1164

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\
1⤵
PID:596
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2852
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2040

C:\Windows\IME\imekr8\dicts\backup.exe
C:\Windows\IME\imekr8\dicts\backup.exe C:\Windows\IME\imekr8\dicts\
1⤵
PID:1508

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\
1⤵
PID:560
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2604
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2480

C:\Windows\IME\IMETC10\HELP\backup.exe
C:\Windows\IME\IMETC10\HELP\backup.exe C:\Windows\IME\IMETC10\HELP\
1⤵
PID:2044

C:\Windows\inf\backup.exe
C:\Windows\inf\backup.exe C:\Windows\inf\
1⤵
PID:2620
- C:\Windows\inf\ASP.NET_4.0.30319\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\
  2⤵
  PID:2092
- - C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe
    C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0006\
    3⤵
    PID:1356
- - C:\Windows\inf\ASP.NET_4.0.30319\000E\backup.exe
    C:\Windows\inf\ASP.NET_4.0.30319\000E\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000E\
    3⤵
    PID:2564
- - C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe
    C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\
    3⤵
    PID:1528
- - C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe
    C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0012\
    3⤵
    PID:2604
- - C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe
    C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0015\
    3⤵
    PID:1984
- C:\Windows\inf\aspnet_state\update.exe
  C:\Windows\inf\aspnet_state\update.exe C:\Windows\inf\aspnet_state\
  2⤵
  PID:1140
- - C:\Windows\inf\aspnet_state\0007\backup.exe
    C:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\
    3⤵
    PID:916
- - C:\Windows\inf\aspnet_state\0014\backup.exe
    C:\Windows\inf\aspnet_state\0014\backup.exe C:\Windows\inf\aspnet_state\0014\
    3⤵
    PID:1088
- - C:\Windows\inf\aspnet_state\0404\backup.exe
    C:\Windows\inf\aspnet_state\0404\backup.exe C:\Windows\inf\aspnet_state\0404\
    3⤵
    PID:2232
- - C:\Windows\inf\aspnet_state\0416\backup.exe
    C:\Windows\inf\aspnet_state\0416\backup.exe C:\Windows\inf\aspnet_state\0416\
    3⤵
    PID:2772
- - C:\Windows\inf\aspnet_state\0816\backup.exe
    C:\Windows\inf\aspnet_state\0816\backup.exe C:\Windows\inf\aspnet_state\0816\
    3⤵
    PID:684
- C:\Windows\inf\en-US\backup.exe
  C:\Windows\inf\en-US\backup.exe C:\Windows\inf\en-US\
  2⤵
  PID:1876
- C:\Windows\inf\ja-JP\backup.exe
  C:\Windows\inf\ja-JP\backup.exe C:\Windows\inf\ja-JP\
  2⤵
  PID:568
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\
  2⤵
  PID:2012
- - C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\backup.exe
    "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\
    3⤵
    PID:2624
- - C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe
    "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\
    3⤵
    PID:536
- - C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\backup.exe
    "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\
    3⤵
    PID:2844
- C:\Windows\inf\rdyboost\backup.exe
  C:\Windows\inf\rdyboost\backup.exe C:\Windows\inf\rdyboost\
  2⤵
  PID:352
- - C:\Windows\inf\rdyboost\0000\backup.exe
    C:\Windows\inf\rdyboost\0000\backup.exe C:\Windows\inf\rdyboost\0000\
    3⤵
    PID:1204
- C:\Windows\inf\usbhub\System Restore.exe
  "C:\Windows\inf\usbhub\System Restore.exe" C:\Windows\inf\usbhub\
  2⤵
  PID:848
- - C:\Windows\inf\usbhub\0000\System Restore.exe
    "C:\Windows\inf\usbhub\0000\System Restore.exe" C:\Windows\inf\usbhub\0000\
    3⤵
    PID:1072
- - C:\Windows\inf\usbhub\0409\backup.exe
    C:\Windows\inf\usbhub\0409\backup.exe C:\Windows\inf\usbhub\0409\
    3⤵
    PID:972
- C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\
  2⤵
  PID:1948
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\
    3⤵
    PID:1872
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\
    3⤵
    PID:1820
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000C\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000C\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000C\
    3⤵
    PID:2484
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\
    3⤵
    PID:2748
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0015\
    3⤵
    PID:2952
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\
    3⤵
    PID:2056
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\
    3⤵
    PID:3008

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:872

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2872

C:\Windows\inf\ASP.NET\000A\backup.exe
C:\Windows\inf\ASP.NET\000A\backup.exe C:\Windows\inf\ASP.NET\000A\
1⤵
PID:2396

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2916

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\
1⤵
PID:892

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:408

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\
1⤵
PID:2680

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\
1⤵
PID:2424
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1544

C:\Windows\inf\ASP.NET\0416\backup.exe
C:\Windows\inf\ASP.NET\0416\backup.exe C:\Windows\inf\ASP.NET\0416\
1⤵
PID:2444

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2668

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1456

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2500

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2832

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2400

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2832

C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1224

C:\Windows\inf\BITS\0000\backup.exe
C:\Windows\inf\BITS\0000\backup.exe C:\Windows\inf\BITS\0000\
1⤵
PID:1204

C:\Windows\inf\BITS\040C\backup.exe
C:\Windows\inf\BITS\040C\backup.exe C:\Windows\inf\BITS\040C\
1⤵
PID:2840

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\
1⤵
PID:2196

C:\Windows\inf\BITS\0410\backup.exe
C:\Windows\inf\BITS\0410\backup.exe C:\Windows\inf\BITS\0410\
1⤵
PID:1792

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1956

C:\Windows\inf\BITS\0C0A\backup.exe
C:\Windows\inf\BITS\0C0A\backup.exe C:\Windows\inf\BITS\0C0A\
1⤵
PID:2068

C:\Windows\inf\ESENT\0407\backup.exe
C:\Windows\inf\ESENT\0407\backup.exe C:\Windows\inf\ESENT\0407\
1⤵
PID:2792

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\
1⤵
PID:2636

C:\Windows\inf\ESENT\0C0A\backup.exe
C:\Windows\inf\ESENT\0C0A\backup.exe C:\Windows\inf\ESENT\0C0A\
1⤵
PID:2744

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:1084

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1772

C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\
1⤵
PID:2712

C:\Windows\inf\MSDTC\0000\backup.exe
C:\Windows\inf\MSDTC\0000\backup.exe C:\Windows\inf\MSDTC\0000\
1⤵
PID:992

C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\
1⤵
PID:556

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\
1⤵
PID:2156

C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\
1⤵
PID:2052

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\
1⤵
PID:2084

C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\
1⤵
PID:1740

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\data.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\data.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\
1⤵
PID:2644

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\
1⤵
PID:2892

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\
1⤵
PID:2816

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\
1⤵
PID:2260

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2160

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2440

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2052

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\
1⤵
PID:2824

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:376

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2076

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1300

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1636

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2676

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1524

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\
1⤵
PID:1536

C:\Windows\inf\PERFLIB\040C\backup.exe
C:\Windows\inf\PERFLIB\040C\backup.exe C:\Windows\inf\PERFLIB\040C\
1⤵
PID:2060

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\
1⤵
PID:2148

C:\Windows\inf\PNRPSvc\0407\backup.exe
C:\Windows\inf\PNRPSvc\0407\backup.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2852

C:\Windows\inf\PNRPSvc\040C\backup.exe
C:\Windows\inf\PNRPSvc\040C\backup.exe C:\Windows\inf\PNRPSvc\040C\
1⤵
PID:2792

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\42c8856d883c21388965cd6c8a8b54a1\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\42c8856d883c21388965cd6c8a8b54a1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\42c8856d883c21388965cd6c8a8b54a1\
1⤵
PID:768

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\
1⤵
PID:2668
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\
  2⤵
  PID:2084
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\
  2⤵
  PID:596
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\update.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\
  2⤵
  PID:2640

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\
1⤵
PID:1760
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2772

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2112

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\
1⤵
PID:1636

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2464

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\
1⤵
PID:1984

C:\Windows\inf\RemoteAccess\0000\backup.exe
C:\Windows\inf\RemoteAccess\0000\backup.exe C:\Windows\inf\RemoteAccess\0000\
1⤵
PID:560

C:\Windows\inf\RemoteAccess\0407\update.exe
C:\Windows\inf\RemoteAccess\0407\update.exe C:\Windows\inf\RemoteAccess\0407\
1⤵
PID:772

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\
1⤵
PID:704

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2336

C:\Windows\inf\RemoteAccess\040C\backup.exe
C:\Windows\inf\RemoteAccess\040C\backup.exe C:\Windows\inf\RemoteAccess\040C\
1⤵
PID:2916

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2564

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\
1⤵
PID:1516

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2672

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2396

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\
1⤵
PID:2784

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\
1⤵
PID:2524

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\
1⤵
PID:2684

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\
1⤵
PID:1848

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2176

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\
1⤵
PID:3024

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\
1⤵
PID:1776

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1528

C:\Windows\inf\ServiceModelService 3.0.0.0\0410\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0410\
1⤵
PID:2320

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\d660f850b373b57c4e22a7100feeb1a4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\d660f850b373b57c4e22a7100feeb1a4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\d660f850b373b57c4e22a7100feeb1a4\
1⤵
PID:560

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\
1⤵
PID:1672

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1544

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\
1⤵
PID:1828

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\
1⤵
PID:3052

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\
1⤵
PID:972
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\
  2⤵
  PID:2696

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\
1⤵
PID:1816
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2648

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\
1⤵
PID:1468
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\
  2⤵
  PID:2028

C:\Windows\inf\SMSvcHost 4.0.0.0\0001\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0001\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0001\
1⤵
PID:1644

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\
1⤵
PID:2500

C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\
1⤵
PID:2092

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\
1⤵
PID:1088

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\
1⤵
PID:1636

C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0014\
1⤵
PID:2824

C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\
1⤵
PID:2244

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\
1⤵
PID:2440

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1872

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1508

C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0404\
1⤵
PID:1504

C:\Windows\inf\SMSvcHost 4.0.0.0\0416\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0416\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0416\
1⤵
PID:268

C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0816\
1⤵
PID:1084

C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\
1⤵
PID:604

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\
1⤵
PID:2188
- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\
  2⤵
  PID:1668

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2312

C:\Windows\inf\TermService\0000\backup.exe
C:\Windows\inf\TermService\0000\backup.exe C:\Windows\inf\TermService\0000\
1⤵
PID:2564

C:\Windows\inf\TermService\0407\update.exe
C:\Windows\inf\TermService\0407\update.exe C:\Windows\inf\TermService\0407\
1⤵
PID:2744

C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\
1⤵
PID:2592
- C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\System Restore.exe
  "C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\
  2⤵
  PID:2796

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\
1⤵
PID:536
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:992

C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\
1⤵
PID:2632

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\
1⤵
PID:1032
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:1508

C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\
1⤵
PID:2964

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\
1⤵
PID:2024

C:\Windows\inf\UGatherer\040C\backup.exe
C:\Windows\inf\UGatherer\040C\backup.exe C:\Windows\inf\UGatherer\040C\
1⤵
PID:2960

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\
1⤵
PID:2056

C:\Windows\inf\UGTHRSVC\0407\backup.exe
C:\Windows\inf\UGTHRSVC\0407\backup.exe C:\Windows\inf\UGTHRSVC\0407\
1⤵
PID:2884

C:\Windows\inf\UGTHRSVC\0411\backup.exe
C:\Windows\inf\UGTHRSVC\0411\backup.exe C:\Windows\inf\UGTHRSVC\0411\
1⤵
PID:816

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\
1⤵
PID:1788

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2316

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2800

C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\
1⤵
PID:1812

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2124

C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\
1⤵
PID:1532

C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\
1⤵
PID:2512

C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0411\System Restore.exe
"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0411\System Restore.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0411\
1⤵
PID:1772

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1728

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\
1⤵
PID:1580

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:568

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\
1⤵
PID:1280

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2844

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:704

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\
1⤵
PID:604

C:\Windows\L2Schemas\backup.exe
C:\Windows\L2Schemas\backup.exe C:\Windows\L2Schemas\
1⤵
PID:2684

C:\Windows\LiveKernelReports\backup.exe
C:\Windows\LiveKernelReports\backup.exe C:\Windows\LiveKernelReports\
1⤵
PID:2076

C:\Windows\Logs\backup.exe
C:\Windows\Logs\backup.exe C:\Windows\Logs\
1⤵
PID:1140

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\
1⤵
PID:2672

C:\Windows\Media\Calligraphy\backup.exe
C:\Windows\Media\Calligraphy\backup.exe C:\Windows\Media\Calligraphy\
1⤵
PID:304

C:\Windows\Media\Characters\backup.exe
C:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\
1⤵
PID:2856

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\
1⤵
PID:2684
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\
  2⤵
  PID:2280

C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1160

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2796

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_it_31bf3856ad364e35\
1⤵
PID:772

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\
1⤵
PID:1084

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\
1⤵
PID:2848

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\52873358b397c328168f0a5be7f3b9ae\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\52873358b397c328168f0a5be7f3b9ae\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\52873358b397c328168f0a5be7f3b9ae\
1⤵
PID:568

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2360

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\
1⤵
PID:2160
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\
  2⤵
  PID:2744
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ced847eb933ffee8e1a2e738205916ce\
  2⤵
  PID:376

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1292

C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\
1⤵
PID:1280
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\
  2⤵
  PID:1544
- - C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
    C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\
    3⤵
    PID:2092
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\
  2⤵
  PID:896
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\
  2⤵
  PID:2592

C:\Windows\inf\wsearchidxpi\0411\backup.exe
C:\Windows\inf\wsearchidxpi\0411\backup.exe C:\Windows\inf\wsearchidxpi\0411\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:556

C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\
1⤵
PID:2128

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\
1⤵
PID:2136
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\
  2⤵
  PID:3032

C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2712

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2440

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\
1⤵
PID:2532

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2596

C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\
1⤵
PID:3056

C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2344

C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2240

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1044

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\
1⤵
PID:1832

C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2036

C:\Windows\assembly\GAC_MSIL\office\backup.exe
C:\Windows\assembly\GAC_MSIL\office\backup.exe C:\Windows\assembly\GAC_MSIL\office\
1⤵
PID:268

C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\
1⤵
PID:820

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\0728af1479c3388cadf85ccfc2b12582\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\0728af1479c3388cadf85ccfc2b12582\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\0728af1479c3388cadf85ccfc2b12582\
1⤵
PID:1208

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\update.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2248

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\
1⤵
PID:1300

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2484

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\
1⤵
PID:1224

C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\
1⤵
PID:2888

C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\
1⤵
PID:528

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\
1⤵
PID:1968
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\
  2⤵
  PID:1552

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2964

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:704

C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\
1⤵
PID:2248

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\
1⤵
PID:1964

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\data.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1984

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\data.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2584

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\
1⤵
PID:2856

C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\
1⤵
PID:2540

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:1900

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\
1⤵
PID:1804

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\
1⤵
PID:1792

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\
1⤵
PID:1580

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\
1⤵
PID:1416

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\
1⤵
PID:2028

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\
1⤵
PID:2676
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\
  2⤵
  PID:2736

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3028

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\
1⤵
PID:1356
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\
  2⤵
  PID:2144

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\
1⤵
PID:308

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\
1⤵
PID:3000

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\
1⤵
PID:1668

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\
1⤵
PID:2628
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\50691bdee045a2df00f00ac461844c5f\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\50691bdee045a2df00f00ac461844c5f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\50691bdee045a2df00f00ac461844c5f\
  2⤵
  PID:2356

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\
1⤵
PID:2384

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2956

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\
1⤵
PID:2960

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\70823ac0d6e6631a11d443bf38987cc9\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\70823ac0d6e6631a11d443bf38987cc9\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\70823ac0d6e6631a11d443bf38987cc9\
1⤵
PID:1108

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\
1⤵
PID:2588

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\
1⤵
PID:3008

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\
1⤵
PID:896

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\
1⤵
PID:2192

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\9f570489c98c93a79f0fd793586afdc6\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\9f570489c98c93a79f0fd793586afdc6\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\9f570489c98c93a79f0fd793586afdc6\
1⤵
PID:1360

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1280

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1724

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\
1⤵
PID:768

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\
1⤵
PID:2244

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\
1⤵
PID:340

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:600

C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\
1⤵
PID:1364
- C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\
  2⤵
  PID:2876

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\
1⤵
PID:1576

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2260

C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\
1⤵
PID:2524
- C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\
  2⤵
  PID:2580

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\
1⤵
PID:1072
- C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1824

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\
1⤵
PID:2156
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\data.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:624

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\2101dbd9fa083a2ed0cc112636260070\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\2101dbd9fa083a2ed0cc112636260070\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\2101dbd9fa083a2ed0cc112636260070\
1⤵
PID:924

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcepg\13b4ad00d1167ff3ed7d2a8e4994f1ff\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcepg\13b4ad00d1167ff3ed7d2a8e4994f1ff\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcepg\13b4ad00d1167ff3ed7d2a8e4994f1ff\
1⤵
PID:684

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\
1⤵
PID:2100

C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\
1⤵
PID:2608

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\
1⤵
PID:2776
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\
  2⤵
  PID:1276

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\
1⤵
PID:1664

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1652

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1716

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\
1⤵
PID:2784

C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\
1⤵
PID:1032

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:2032

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\
1⤵
PID:2540

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\
1⤵
PID:1544

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\
1⤵
PID:3056

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\
1⤵
PID:2536

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\
1⤵
PID:784

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\
1⤵
PID:1796

C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\
1⤵
PID:1168

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2684

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\
1⤵
PID:968

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\
1⤵
PID:2716

C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\update.exe
C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\update.exe C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\
1⤵
PID:2316

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\update.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1776

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\8d64f031cf429f4ce79642e8be267d2d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\8d64f031cf429f4ce79642e8be267d2d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\8d64f031cf429f4ce79642e8be267d2d\
1⤵
PID:2620

C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\
1⤵
PID:2032
- C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1552

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:528

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\6820836e29efa97200d3fcfb4d0f170b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\6820836e29efa97200d3fcfb4d0f170b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\6820836e29efa97200d3fcfb4d0f170b\
1⤵
PID:1516

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2124

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\
1⤵
PID:1208
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\
  2⤵
  PID:1060

C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\
1⤵
PID:2980

C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\
1⤵
PID:2904

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1624

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\
1⤵
PID:896

C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\
1⤵
PID:2728

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\3cf3740de20740208d614d330aa4416c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\3cf3740de20740208d614d330aa4416c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\3cf3740de20740208d614d330aa4416c\
1⤵
PID:1164

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1680

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1504

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\
1⤵
PID:1264

C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\
1⤵
PID:3032

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\data.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2096

C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\System Restore.exe" C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\
1⤵
PID:1876
- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2460
- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:2876

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\update.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\
1⤵
PID:1820

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemDrawing\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2436

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3d4632e11d04d8db85c98485b1622bae\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3d4632e11d04d8db85c98485b1622bae\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3d4632e11d04d8db85c98485b1622bae\
1⤵
PID:1208

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\
1⤵
PID:2020
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\
  2⤵
  PID:3008

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:1628

C:\Windows\assembly\GAC_MSIL\PresentationFramework\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationFramework\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationFramework\
1⤵
PID:968

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\
1⤵
PID:1848

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
ceeb3babf55a922be726bb5f969999f9

SHA1
282e5e028a62f2f329ef01f9a6910e45d73be02d

SHA256
101737441113b06d66bc5cb05677049b545a2483958e45259e2d1141a9c262d2

SHA512
1ea7318f815bf8699bd0b773b1d820cc2ec61d44be07dd2233c6d9871957bde6de2a793d4e08a0765b6e216a3cd7548fa93d33997a2cdfb3c1c92d8452d8a746

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
3d96d87ba73b7db938784d04722a9596

SHA1
5a47db98503f0703830868a3993686c1b411ece8

SHA256
39649f5d5222bb0f799d3836d3c6c58d248c0132de150ffeb8ae7718a2b49cea

SHA512
d5559579ef5c4b70df3a4b8566ce9659d41ac2844deaae2041580e7a72ad85767f3e022ebc2cc573fd496743ebb3498a8cb0de6eada248af51b0a6176873ea34

Download Submit
C:\Users\Admin\AppData\Local\Temp\2160736382\backup.exe

Filesize
72KB

MD5
5d68695704c2a46c147706569e2d33e5

SHA1
05219f31357b11c4ab466c68a9686b50488e9fa0

SHA256
879cbc31f3ddb69b9882fa67fa38ae6845feeaae976b4574879c383a691ad607

SHA512
255573caa3875f678db3eac50ef342e9dfed787c53083bbe67583f77746123fc65b81edc901a0041735ffd3fbe0a857f21a75735623b80c7b80c8b2fd539dea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
727b5ff325b32f3eb8b469bdf484c5be

SHA1
baceb0e6f681fdc801bbac50259b7660316c100b

SHA256
529ff1a806ee310286e7a14d5701a3a036295d7410201856d262e3e5308b3cab

SHA512
fa065ea553cc2226251238d2b761800bbd05962782ca4a2abeaf1c04b83d8b0930ca0d97303ed3b40da0350ac0837254cc00271db587bc4e423d0086e3e97635

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
72KB

MD5
488e227cb14b2ab44932dccec0329f97

SHA1
19bdc72c5ca54336f5588df72d768c0d34a2d067

SHA256
c543e4ece00d628a993152555583bdcdbcdacb072e1543036a51bb78804ac456

SHA512
2eb727a473b10c651adae525513d5735d574aba47a6a950a00c43ea1e6db27bc7d276380d020c231f392d6f3da4b1662616212fd2c58269c39c1defbe218f30d

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
1e6aa15fb14e43d4edda0f7ae23c4ec8

SHA1
2823da7c492cf9996a243c6ba5c1f3eae0b2f932

SHA256
3dfd5f6a374d7452ba7255e9a63af379fc68439212498f6268652afa39ce4872

SHA512
0fbd81324f39c56ec79b3841ca6e65a5c296a5b2bbaaa76e88664b7a2796f2165c491893db2930b4c6a36e4cc17b3d97782f51765708c4902c29df5baf1d3014

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
1b227747f79904551dac89793ddea02f

SHA1
5bcbcae98ae41c6de39949664ae64889d8fb0ef8

SHA256
4d875c3270bea9f0ba00c5d85b372de21a2d4f765f029adaacdca949ecd870b7

SHA512
1dcfc43330c324c50012c94b40936ad3f303af700f1d6a900aa5035909bd33bf96503df489e3ffe5128aac8c6794482832c9cd9674b990e726bd84fbc2a9830a

Download Submit
memory/784-10432-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/908-8345-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1132-20476-0x00000000774F0000-0x00000000775EA000-memory.dmp

Filesize
1000KB

Download
memory/1132-15379-0x0000000002980000-0x0000000002A90000-memory.dmp

Filesize
1.1MB

Download
memory/1312-9778-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/1960-18427-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2012-11778-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2024-8553-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2240-20357-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2272-15957-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2748-20050-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2828-6657-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/3008-18123-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads