Analysis
-
max time kernel
91s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe
Resource
win10v2004-20240426-en
General
-
Target
d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe
-
Size
72KB
-
MD5
a7ce7c31c26e81a4f06ba5dd5465730c
-
SHA1
465b2358627a4ed25313bbd3ae2e972512831b40
-
SHA256
d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6
-
SHA512
380d184ee364c01d88f8094ebaafa3aa59dad15f6da9b7c22ad660bb284f4d87e13b25fac6d72a7b77db85e5cee3ba3942bb61531f6ede8a61b5125565f38340
-
SSDEEP
384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2j:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrv
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2056 System Restore.exe 2068 backup.exe 2612 backup.exe 2692 backup.exe 2220 backup.exe 2784 backup.exe 2576 data.exe 2528 backup.exe 2924 backup.exe 1992 update.exe 2700 backup.exe 1668 backup.exe 1960 backup.exe 1308 backup.exe 2356 backup.exe 2900 backup.exe 2912 backup.exe 2864 backup.exe 2224 backup.exe 1240 backup.exe 1468 backup.exe 1896 backup.exe 2336 backup.exe 1228 data.exe 2704 backup.exe 1532 backup.exe 952 System Restore.exe 1628 backup.exe 340 backup.exe 1268 update.exe 2980 backup.exe 3060 backup.exe 1148 backup.exe 884 backup.exe 2604 backup.exe 2200 data.exe 2616 backup.exe 2692 backup.exe 2724 backup.exe 840 backup.exe 2520 backup.exe 2496 System Restore.exe 2976 backup.exe 2936 backup.exe 1688 data.exe 2712 backup.exe 2696 backup.exe 2024 backup.exe 1840 backup.exe 1860 backup.exe 1880 backup.exe 1744 backup.exe 1980 backup.exe 1548 backup.exe 2000 backup.exe 1516 backup.exe 2900 backup.exe 2196 backup.exe 540 backup.exe 548 backup.exe 1800 backup.exe 692 backup.exe 2436 data.exe 976 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2576 data.exe 2576 data.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2924 backup.exe 1992 update.exe 1992 update.exe 1992 update.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 1668 backup.exe 1668 backup.exe 1960 backup.exe 1960 backup.exe 1668 backup.exe 1668 backup.exe 2356 backup.exe 2356 backup.exe 2900 backup.exe 2900 backup.exe 2356 backup.exe 2356 backup.exe 2864 backup.exe 2864 backup.exe 2224 backup.exe 2224 backup.exe 2224 backup.exe 2224 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1268 update.exe 1268 update.exe 1268 update.exe 1468 backup.exe 1468 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 2056 System Restore.exe 2068 backup.exe 2612 backup.exe 2692 backup.exe 2220 backup.exe 2784 backup.exe 2576 data.exe 2528 backup.exe 2924 backup.exe 1992 update.exe 2700 backup.exe 1668 backup.exe 1960 backup.exe 1308 backup.exe 2356 backup.exe 2900 backup.exe 2912 backup.exe 2864 backup.exe 2224 backup.exe 1240 backup.exe 1468 backup.exe 1896 backup.exe 2336 backup.exe 1228 data.exe 2704 backup.exe 1532 backup.exe 952 System Restore.exe 1628 backup.exe 340 backup.exe 1268 update.exe 2980 backup.exe 3060 backup.exe 1148 backup.exe 884 backup.exe 2604 backup.exe 2200 data.exe 2616 backup.exe 2692 backup.exe 2724 backup.exe 840 backup.exe 2520 backup.exe 2496 System Restore.exe 2976 backup.exe 2936 backup.exe 1688 data.exe 2712 backup.exe 2696 backup.exe 2024 backup.exe 1840 backup.exe 1860 backup.exe 1880 backup.exe 1744 backup.exe 1980 backup.exe 1548 backup.exe 2000 backup.exe 1516 backup.exe 2900 backup.exe 2196 backup.exe 540 backup.exe 548 backup.exe 1800 backup.exe 692 backup.exe 2436 data.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2056 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 28 PID 2548 wrote to memory of 2056 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 28 PID 2548 wrote to memory of 2056 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 28 PID 2548 wrote to memory of 2056 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 28 PID 2548 wrote to memory of 2068 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 29 PID 2548 wrote to memory of 2068 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 29 PID 2548 wrote to memory of 2068 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 29 PID 2548 wrote to memory of 2068 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 29 PID 2548 wrote to memory of 2612 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 30 PID 2548 wrote to memory of 2612 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 30 PID 2548 wrote to memory of 2612 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 30 PID 2548 wrote to memory of 2612 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 30 PID 2548 wrote to memory of 2692 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 31 PID 2548 wrote to memory of 2692 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 31 PID 2548 wrote to memory of 2692 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 31 PID 2548 wrote to memory of 2692 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 31 PID 2548 wrote to memory of 2220 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 32 PID 2548 wrote to memory of 2220 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 32 PID 2548 wrote to memory of 2220 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 32 PID 2548 wrote to memory of 2220 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 32 PID 2548 wrote to memory of 2784 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 33 PID 2548 wrote to memory of 2784 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 33 PID 2548 wrote to memory of 2784 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 33 PID 2548 wrote to memory of 2784 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 33 PID 2548 wrote to memory of 2576 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 34 PID 2548 wrote to memory of 2576 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 34 PID 2548 wrote to memory of 2576 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 34 PID 2548 wrote to memory of 2576 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 34 PID 2576 wrote to memory of 2528 2576 data.exe 35 PID 2576 wrote to memory of 2528 2576 data.exe 35 PID 2576 wrote to memory of 2528 2576 data.exe 35 PID 2576 wrote to memory of 2528 2576 data.exe 35 PID 2548 wrote to memory of 2924 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 36 PID 2548 wrote to memory of 2924 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 36 PID 2548 wrote to memory of 2924 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 36 PID 2548 wrote to memory of 2924 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 36 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2924 wrote to memory of 1992 2924 backup.exe 37 PID 2548 wrote to memory of 2700 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 38 PID 2548 wrote to memory of 2700 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 38 PID 2548 wrote to memory of 2700 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 38 PID 2548 wrote to memory of 2700 2548 d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe 38 PID 2056 wrote to memory of 1668 2056 System Restore.exe 39 PID 2056 wrote to memory of 1668 2056 System Restore.exe 39 PID 2056 wrote to memory of 1668 2056 System Restore.exe 39 PID 2056 wrote to memory of 1668 2056 System Restore.exe 39 PID 1668 wrote to memory of 1960 1668 backup.exe 40 PID 1668 wrote to memory of 1960 1668 backup.exe 40 PID 1668 wrote to memory of 1960 1668 backup.exe 40 PID 1668 wrote to memory of 1960 1668 backup.exe 40 PID 1960 wrote to memory of 1308 1960 backup.exe 41 PID 1960 wrote to memory of 1308 1960 backup.exe 41 PID 1960 wrote to memory of 1308 1960 backup.exe 41 PID 1960 wrote to memory of 1308 1960 backup.exe 41 PID 1668 wrote to memory of 2356 1668 backup.exe 42 PID 1668 wrote to memory of 2356 1668 backup.exe 42 PID 1668 wrote to memory of 2356 1668 backup.exe 42 PID 1668 wrote to memory of 2356 1668 backup.exe 42 PID 2356 wrote to memory of 2900 2356 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe"C:\Users\Admin\AppData\Local\Temp\d73f575fdbfd45218352e153f54d1ba55239d3ea96572df9947caeaaa2ccbbe6.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2260551732\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\2260551732\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2260551732\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1308
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2356 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2900 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:340
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2200
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2496
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
PID:864
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2384
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Drops file in Program Files directory
- System policy modification
PID:2188 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1032
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2060
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2248
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2996
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:844 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2620
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2732
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2748
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2636 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2716
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2508
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Disables RegEdit via registry modification
PID:2576
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:2180
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1420
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:2452
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2792
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:2140
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:2156
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2132
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:2916
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2176
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2940
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:2040
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:2444
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:536
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1476
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵PID:1796
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵PID:648
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:1072
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:2100
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1768
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1652
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1612
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2836
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:920
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:696
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1368
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2896
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2668
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:2852
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:2676
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:2208
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2708
-
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:812
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵PID:2532
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵PID:2924
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵PID:1852
-
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵PID:1976
-
-
C:\Program Files\Java\System Restore.exe"C:\Program Files\Java\System Restore.exe" C:\Program Files\Java\5⤵PID:2788
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:632
-
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:3064
-
-
-
-
C:\Program Files\Windows Photo Viewer\backup.exe"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\5⤵PID:648
-
C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe"C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files\Windows Photo Viewer\fr-FR\6⤵PID:1660
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵PID:2804
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵PID:2000
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵PID:2228
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1960
-
-
C:\Program Files (x86)\MSBuild\backup.exe"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\5⤵PID:2660
-
C:\Program Files (x86)\MSBuild\Microsoft\backup.exe"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\6⤵PID:2488
-
-
-
C:\Program Files (x86)\Reference Assemblies\System Restore.exe"C:\Program Files (x86)\Reference Assemblies\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\5⤵PID:1368
-
-
C:\Program Files (x86)\Windows Media Player\backup.exe"C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\5⤵PID:2492
-
C:\Program Files (x86)\Windows Media Player\en-US\backup.exe"C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\6⤵PID:2060
-
-
C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\6⤵PID:2116
-
-
C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe"C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\6⤵PID:2612
-
-
C:\Program Files (x86)\Windows Media Player\Skins\update.exe"C:\Program Files (x86)\Windows Media Player\Skins\update.exe" C:\Program Files (x86)\Windows Media Player\Skins\6⤵PID:2424
-
-
C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe"C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\6⤵PID:2900
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:2476
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:836
-
C:\Windows\assembly\GAC_64\backup.exeC:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\6⤵PID:2772
-
C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\data.exeC:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\data.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\7⤵PID:892
-
-
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exeC:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\7⤵PID:1784
-
-
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exeC:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\7⤵PID:1492
-
-
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\System Restore.exe"C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\System Restore.exe" C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\7⤵PID:1956
-
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\8⤵PID:2368
-
-
-
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exeC:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\7⤵PID:1784
-
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\8⤵PID:1880
-
-
-
C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exeC:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\7⤵PID:2500
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\6⤵PID:2936
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\7⤵PID:2616
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\7⤵PID:2480
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\7⤵PID:2752
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\7⤵PID:2352
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7⤵PID:2116
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\7⤵PID:1756
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\8⤵PID:2864
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\8⤵PID:1768
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7⤵PID:2220
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7⤵PID:1880
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\data.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\7⤵PID:3004
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\8⤵PID:1520
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\7⤵PID:1228
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\7⤵PID:1496
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\8⤵PID:2448
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\7⤵PID:2844
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\7⤵PID:2248
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\7⤵PID:1616
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\7⤵PID:2672
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\7⤵PID:2944
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\7⤵PID:468
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\8⤵PID:2660
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\7⤵PID:648
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\7⤵PID:2508
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\8⤵PID:2640
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\7⤵PID:1840
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\7⤵PID:1520
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\7⤵PID:1788
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\7⤵PID:3060
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\data.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\7⤵PID:660
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\7⤵PID:1804
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\8⤵PID:1876
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\7⤵PID:2976
-
-
-
-
C:\Windows\ehome\backup.exeC:\Windows\ehome\backup.exe C:\Windows\ehome\5⤵PID:2572
-
C:\Windows\ehome\CreateDisc\backup.exeC:\Windows\ehome\CreateDisc\backup.exe C:\Windows\ehome\CreateDisc\6⤵PID:2148
-
C:\Windows\ehome\CreateDisc\Components\backup.exeC:\Windows\ehome\CreateDisc\Components\backup.exe C:\Windows\ehome\CreateDisc\Components\7⤵PID:1528
-
-
C:\Windows\ehome\CreateDisc\Filters\backup.exeC:\Windows\ehome\CreateDisc\Filters\backup.exe C:\Windows\ehome\CreateDisc\Filters\7⤵PID:328
-
-
C:\Windows\ehome\CreateDisc\SFXPlugins\data.exeC:\Windows\ehome\CreateDisc\SFXPlugins\data.exe C:\Windows\ehome\CreateDisc\SFXPlugins\7⤵PID:2376
-
-
C:\Windows\ehome\CreateDisc\style\backup.exeC:\Windows\ehome\CreateDisc\style\backup.exe C:\Windows\ehome\CreateDisc\style\7⤵PID:2612
-
-
-
C:\Windows\ehome\en-US\backup.exeC:\Windows\ehome\en-US\backup.exe C:\Windows\ehome\en-US\6⤵PID:1496
-
-
C:\Windows\ehome\ja-JP\backup.exeC:\Windows\ehome\ja-JP\backup.exe C:\Windows\ehome\ja-JP\6⤵PID:2488
-
-
-
C:\Windows\fr-FR\backup.exeC:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\5⤵PID:632
-
-
C:\Windows\Logs\backup.exeC:\Windows\Logs\backup.exe C:\Windows\Logs\5⤵PID:2864
-
C:\Windows\Logs\CBS\backup.exeC:\Windows\Logs\CBS\backup.exe C:\Windows\Logs\CBS\6⤵PID:2856
-
-
C:\Windows\Logs\DISM\data.exeC:\Windows\Logs\DISM\data.exe C:\Windows\Logs\DISM\6⤵PID:1484
-
-
-
C:\Windows\Media\backup.exeC:\Windows\Media\backup.exe C:\Windows\Media\5⤵PID:1112
-
C:\Windows\Media\Afternoon\backup.exeC:\Windows\Media\Afternoon\backup.exe C:\Windows\Media\Afternoon\6⤵PID:1972
-
-
C:\Windows\Media\Calligraphy\backup.exeC:\Windows\Media\Calligraphy\backup.exe C:\Windows\Media\Calligraphy\6⤵PID:2448
-
-
C:\Windows\Media\Characters\backup.exeC:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\6⤵PID:2092
-
-
C:\Windows\Media\Quirky\backup.exeC:\Windows\Media\Quirky\backup.exe C:\Windows\Media\Quirky\6⤵PID:2608
-
-
C:\Windows\Media\Savanna\backup.exeC:\Windows\Media\Savanna\backup.exe C:\Windows\Media\Savanna\6⤵PID:2000
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2068
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2220
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2528
-
-
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\update.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\update.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1992
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2700
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\1⤵PID:2036
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\2⤵PID:1532
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\2⤵PID:1096
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\2⤵PID:1032
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\2⤵PID:1568
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\2⤵PID:3000
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\2⤵PID:2656
-
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\1⤵PID:2692
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\2⤵PID:2220
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\3⤵PID:2676
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\4⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\4⤵PID:1040
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\4⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\4⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\4⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\4⤵PID:2564
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\System Restore.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\5⤵PID:1284
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\6⤵PID:2708
-
-
-
-
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\1⤵PID:2560
-
C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\1⤵PID:2704
-
C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\1⤵PID:1540
-
C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\1⤵PID:612
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\1⤵PID:1032
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\2⤵PID:2060
-
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\2⤵PID:2312
-
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\1⤵PID:2604
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\1⤵PID:1720
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\1⤵PID:2468
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\update.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\1⤵PID:2584
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\1⤵PID:284
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\1⤵PID:1772
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\1⤵PID:648
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\1⤵PID:1284
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\1⤵PID:304
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\1⤵PID:2800
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\1⤵PID:2176
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\1⤵PID:1748
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\1⤵PID:780
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\1⤵PID:2196
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\1⤵PID:2092
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\2⤵PID:2100
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\3⤵PID:1552
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\2⤵PID:1004
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\2⤵PID:1244
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\3⤵PID:1072
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\3⤵PID:624
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\3⤵PID:3036
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\3⤵PID:1716
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\3⤵PID:2068
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\3⤵PID:1956
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\3⤵PID:2772
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\3⤵PID:2152
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\data.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\4⤵PID:352
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\update.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\3⤵PID:648
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\4⤵PID:2520
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\3⤵PID:2112
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\4⤵PID:1900
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\3⤵PID:2916
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\4⤵PID:2960
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\3⤵PID:2216
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\3⤵PID:1792
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\4⤵PID:1952
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\data.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\3⤵PID:2940
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\4⤵PID:584
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\3⤵PID:2796
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\4⤵PID:2752
-
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\2⤵PID:3044
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\data.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\3⤵PID:1228
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\4⤵PID:764
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\5⤵PID:3016
-
-
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\2⤵PID:2880
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\3⤵PID:2376
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\data.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\4⤵PID:1496
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\5⤵PID:1300
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\6⤵PID:892
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\6⤵PID:2664
-
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\4⤵PID:844
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\4⤵PID:2616
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\3⤵PID:2780
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\4⤵PID:2728
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\4⤵PID:2668
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\4⤵PID:2976
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\3⤵PID:2756
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\4⤵PID:1688
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\3⤵PID:2640
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\4⤵PID:784
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\5⤵PID:1840
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\4⤵PID:2864
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\4⤵PID:1860
-
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\1⤵PID:2116
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\1⤵PID:1420
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\1⤵PID:2824
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\data.exe"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\1⤵PID:1096
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\1⤵PID:2108
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\1⤵PID:1608
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\2⤵PID:1676
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\1⤵PID:1128
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\2⤵PID:2712
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\2⤵PID:3032
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\1⤵PID:2704
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\1⤵PID:2324
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\1⤵PID:2964
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\2⤵PID:1672
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\2⤵PID:2744
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\3⤵PID:1716
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\1⤵PID:2588
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\2⤵PID:1496
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\1⤵PID:2616
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\2⤵PID:2784
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\2⤵PID:2528
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\3⤵PID:2668
-
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\1⤵PID:2932
-
C:\Program Files\Java\jre7\bin\backup.exe"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\1⤵PID:1972
-
C:\Program Files\Java\jre7\bin\dtplugin\backup.exe"C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\2⤵PID:2824
-
-
C:\Program Files\Java\jre7\bin\plugin2\backup.exe"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\2⤵PID:1996
-
-
C:\Program Files\Java\jre7\bin\server\backup.exe"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\2⤵PID:1740
-
-
C:\Program Files\Java\jre7\lib\System Restore.exe"C:\Program Files\Java\jre7\lib\System Restore.exe" C:\Program Files\Java\jre7\lib\1⤵PID:2132
-
C:\Program Files\Java\jre7\lib\amd64\backup.exe"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\2⤵PID:1960
-
-
C:\Program Files\Java\jre7\lib\applet\backup.exe"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\2⤵PID:1880
-
-
C:\Program Files\Java\jre7\lib\ext\update.exe"C:\Program Files\Java\jre7\lib\ext\update.exe" C:\Program Files\Java\jre7\lib\ext\2⤵PID:1504
-
-
C:\Program Files\Java\jre7\lib\images\backup.exe"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\2⤵PID:1112
-
C:\Program Files\Java\jre7\lib\images\cursors\backup.exe"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\3⤵PID:780
-
-
-
C:\Program Files\Java\jre7\lib\jfr\update.exe"C:\Program Files\Java\jre7\lib\jfr\update.exe" C:\Program Files\Java\jre7\lib\jfr\2⤵PID:1796
-
-
C:\Program Files\Java\jre7\lib\zi\backup.exe"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\2⤵PID:3064
-
C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\3⤵PID:1332
-
-
C:\Program Files\Java\jre7\lib\zi\America\backup.exe"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\3⤵PID:1600
-
C:\Program Files\Java\jre7\lib\zi\America\Indiana\System Restore.exe"C:\Program Files\Java\jre7\lib\zi\America\Indiana\System Restore.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\4⤵PID:764
-
-
-
C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\3⤵PID:3044
-
-
C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\3⤵PID:1884
-
-
C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe"C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\3⤵PID:468
-
-
C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\3⤵PID:1492
-
-
C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\3⤵PID:1868
-
-
C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe"C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\3⤵PID:2580
-
-
C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\3⤵PID:2624
-
-
-
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\1⤵PID:2600
-
C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\1⤵PID:1876
-
C:\Program Files\Microsoft Games\Chess\it-IT\update.exe"C:\Program Files\Microsoft Games\Chess\it-IT\update.exe" C:\Program Files\Microsoft Games\Chess\it-IT\1⤵PID:2936
-
C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\1⤵PID:2552
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\1⤵PID:1800
-
C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\2⤵PID:1896
-
-
C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe"C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\2⤵PID:2648
-
-
C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\2⤵PID:2640
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\1⤵PID:2084
-
C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\2⤵PID:2860
-
-
C:\Program Files\Microsoft Games\Hearts\es-ES\data.exe"C:\Program Files\Microsoft Games\Hearts\es-ES\data.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\2⤵PID:668
-
-
C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\2⤵PID:416
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\1⤵PID:604
-
C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe"C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\1⤵PID:1956
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\1⤵PID:2816
-
C:\Program Files\Microsoft Games\Minesweeper\backup.exe"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\1⤵PID:2208
-
C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\2⤵PID:2808
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\System Restore.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\System Restore.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\2⤵PID:1584
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\1⤵PID:1512
-
C:\Program Files\Microsoft Games\More Games\backup.exe"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\1⤵PID:2944
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\1⤵PID:624
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\1⤵PID:2744
-
C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\data.exe"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\1⤵PID:2492
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\1⤵PID:2376
-
C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\1⤵PID:2968
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\1⤵PID:2516
-
C:\Program Files\Microsoft Games\Multiplayer\Checkers\data.exe"C:\Program Files\Microsoft Games\Multiplayer\Checkers\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\1⤵PID:268
-
C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\2⤵PID:2708
-
-
C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\update.exe"C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\2⤵PID:304
-
-
C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\2⤵PID:2176
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\1⤵PID:1548
-
C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\1⤵PID:2992
-
C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\1⤵PID:2620
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\1⤵PID:2768
-
C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe"C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\1⤵PID:2492
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\1⤵PID:1420
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\1⤵PID:2136
-
C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\2⤵PID:1212
-
-
C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\2⤵PID:1632
-
C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\3⤵PID:2100
-
C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\System Restore.exe"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\4⤵PID:2332
-
-
-
-
C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe"C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\1⤵PID:2916
-
C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\1⤵PID:1968
-
C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\1⤵PID:2112
-
C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\data.exe"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\data.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\1⤵PID:2004
-
C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe"C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\1⤵PID:1268
-
C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\1⤵PID:2604
-
C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe"C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe" C:\Program Files\Microsoft Office\Office14\1033\1⤵PID:1720
-
C:\Program Files\Mozilla Firefox\browser\backup.exe"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\1⤵PID:824
-
C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\1⤵PID:1572
-
C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\1⤵PID:1864
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\1⤵PID:1212
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\1⤵PID:2940
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\2⤵PID:2820
-
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\1⤵PID:3016
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\1⤵PID:1468
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\1⤵PID:772
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\2⤵PID:2460
-
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\2⤵PID:2528
-
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\2⤵PID:2780
-
-
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\1⤵PID:1976
-
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\1⤵PID:1424
-
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\1⤵PID:2476
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\1⤵PID:2652
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\1⤵PID:1972
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\1⤵PID:2220
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\1⤵PID:1852
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\1⤵PID:2708
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\1⤵PID:1516
-
C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\1⤵PID:1476
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\1⤵PID:920
-
C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\1⤵PID:1796
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\1⤵PID:1292
-
C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe"C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\1⤵PID:2588
-
C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\data.exe"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\2⤵PID:1424
-
-
C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\1⤵PID:828
-
C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\1⤵PID:948
-
C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe"C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\1⤵PID:884
-
C:\Program Files\VideoLAN\VLC\locale\br\backup.exe"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\1⤵PID:444
-
C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\1⤵PID:2784
-
C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\1⤵PID:2524
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\update.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\1⤵PID:2108
-
C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\1⤵PID:632
-
C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe"C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\1⤵PID:2636
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\1⤵PID:2224
-
C:\Program Files\VideoLAN\VLC\locale\co\backup.exe"C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\1⤵PID:1960
-
C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe"C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\1⤵PID:300
-
C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\1⤵PID:1476
-
C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\2⤵PID:1292
-
-
C:\Program Files\VideoLAN\VLC\locale\de\data.exe"C:\Program Files\VideoLAN\VLC\locale\de\data.exe" C:\Program Files\VideoLAN\VLC\locale\de\1⤵PID:1300
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\1⤵PID:2764
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\1⤵PID:840
-
C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe"C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eo\1⤵PID:648
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\data.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\1⤵PID:2996
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\1⤵PID:1980
-
C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\1⤵PID:2792
-
C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\1⤵PID:1392
-
C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\1⤵PID:1348
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\1⤵PID:2992
-
C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe"C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\1⤵PID:2104
-
C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\2⤵PID:2652
-
-
C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\1⤵PID:2044
-
C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe"C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\1⤵PID:2220
-
C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\1⤵PID:496
-
C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\data.exe"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\1⤵PID:2228
-
C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe"C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\1⤵PID:1292
-
C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\2⤵PID:3060
-
-
C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe"C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\1⤵PID:2556
-
C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\1⤵PID:2376
-
C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\1⤵PID:2836
-
C:\Program Files\VideoLAN\VLC\locale\it\backup.exe"C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\1⤵PID:1516
-
C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\2⤵PID:1068
-
-
C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\1⤵PID:692
-
C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\System Restore.exe"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\1⤵PID:3016
-
C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\1⤵PID:2840
-
C:\Program Files\VideoLAN\VLC\locale\km\backup.exe"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\1⤵PID:2556
-
C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\update.exe"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\2⤵PID:1976
-
-
C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe"C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\1⤵PID:444
-
C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\2⤵PID:1720
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\1⤵PID:812
-
C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\1⤵PID:2872
-
C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\1⤵PID:1660
-
C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\2⤵PID:2392
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\1⤵PID:1688
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\1⤵PID:2676
-
C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\System Restore.exe"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\1⤵PID:2636
-
C:\Program Files (x86)\Common Files\System\ado\backup.exe"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\1⤵PID:1960
-
C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\1⤵PID:872
-
C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe"C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\1⤵PID:3016
-
C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\1⤵PID:2200
-
C:\Program Files (x86)\Common Files\System\msadc\backup.exe"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\1⤵PID:2156
-
C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\2⤵PID:1040
-
-
C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\2⤵PID:1620
-
-
C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe"C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\1⤵PID:1540
-
C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\2⤵PID:1016
-
-
C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\1⤵PID:2660
-
C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\1⤵PID:1552
-
C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\1⤵PID:3040
-
C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\1⤵PID:2596
-
C:\Program Files\VideoLAN\VLC\locale\or_IN\backup.exe"C:\Program Files\VideoLAN\VLC\locale\or_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or_IN\1⤵PID:2556
-
C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\2⤵PID:2644
-
-
C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\1⤵PID:2648
-
C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\update.exe"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\1⤵PID:304
-
C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\1⤵PID:2916
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\1⤵PID:2156
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\1⤵PID:872
-
C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\1⤵PID:3016
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\data.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\1⤵PID:2520
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\2⤵PID:284
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\3⤵PID:772
-
-
-
C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\1⤵PID:2768
-
C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe"C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\1⤵PID:1740
-
C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe"C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\1⤵PID:2728
-
C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\1⤵PID:824
-
C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1⤵PID:2388
-
C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\1⤵PID:1960
-
C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\1⤵PID:1808
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\1⤵PID:2424
-
C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe"C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\1⤵PID:1516
-
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\2⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\1⤵PID:3044
-
C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe"C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\1⤵PID:604
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\1⤵PID:2608
-
C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\1⤵PID:760
-
C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\1⤵PID:2268
-
C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\1⤵PID:1784
-
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\1⤵PID:2040
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\1⤵PID:1952
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\2⤵PID:2484
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\2⤵PID:2268
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\2⤵PID:1180
-
-
C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe"C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\1⤵PID:1032
-
C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1⤵PID:496
-
C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\1⤵PID:444
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\data.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\1⤵PID:1896
-
C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe"C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\1⤵PID:1096
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\1⤵PID:2944
-
C:\Users\Public\Pictures\Sample Pictures\backup.exe"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\1⤵PID:2632
-
C:\Users\Public\Recorded TV\Sample Media\backup.exe"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\1⤵PID:2180
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\1⤵PID:2036
-
C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe"C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_out\1⤵PID:2176
-
C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe"C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\1⤵PID:2936
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\1⤵PID:3012
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\1⤵PID:2836
-
C:\Windows\AppPatch\fr-FR\backup.exeC:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\1⤵PID:864
-
C:\Windows\AppPatch\ja-JP\backup.exeC:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\1⤵PID:352
-
C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\1⤵PID:2792
-
C:\Windows\assembly\GAC\Extensibility\backup.exeC:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\1⤵PID:3044
-
C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\2⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\1⤵PID:3016
-
C:\Windows\assembly\GAC\Microsoft.Ink\backup.exeC:\Windows\assembly\GAC\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1⤵PID:2944
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\1⤵PID:2572
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\1⤵PID:1420
-
C:\Program Files\Windows Journal\de-DE\backup.exe"C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\1⤵PID:1484
-
C:\Program Files\Windows Journal\en-US\backup.exe"C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\1⤵PID:1672
-
C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exeC:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\1⤵PID:2780
-
C:\Program Files\Windows Journal\Templates\backup.exe"C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\1⤵PID:1600
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\1⤵PID:2744
-
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\1⤵PID:2580
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\1⤵PID:2460
-
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\1⤵PID:1664
-
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exeC:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\1⤵PID:2852
-
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\2⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\1⤵PID:1652
-
C:\Program Files\Windows Media Player\Visualizations\backup.exe"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\1⤵PID:1640
-
C:\Program Files\Windows NT\Accessories\backup.exe"C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\1⤵PID:2944
-
C:\Program Files\Windows NT\Accessories\es-ES\backup.exe"C:\Program Files\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files\Windows NT\Accessories\es-ES\2⤵PID:1512
-
-
C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe"C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe" C:\Program Files\Windows NT\Accessories\fr-FR\2⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\1⤵PID:316
-
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\1⤵PID:1792
-
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\1⤵PID:2368
-
C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe"C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files\Windows NT\TableTextService\de-DE\1⤵PID:668
-
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\1⤵PID:2416
-
C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\1⤵PID:1236
-
C:\Program Files (x86)\Microsoft Office\Office14\OneNote\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\OneNote\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\OneNote\1⤵PID:2464
-
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\1⤵PID:1492
-
C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\1⤵PID:2844
-
C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\System Restore.exe"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\1⤵PID:320
-
C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\1⤵PID:1860
-
C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\1⤵PID:2092
-
C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\1⤵PID:2596
-
C:\Program Files (x86)\Microsoft Office\Stationery\1033\update.exe"C:\Program Files (x86)\Microsoft Office\Stationery\1033\update.exe" C:\Program Files (x86)\Microsoft Office\Stationery\1033\1⤵PID:1096
-
C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe"C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\1⤵PID:760
-
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\1⤵PID:1016
-
C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\1⤵PID:1876
-
C:\Windows\assembly\GAC_32\MSBuild\update.exeC:\Windows\assembly\GAC_32\MSBuild\update.exe C:\Windows\assembly\GAC_32\MSBuild\1⤵PID:2704
-
C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\2⤵PID:2648
-
-
C:\Windows\assembly\GAC_32\mscorlib\backup.exeC:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\1⤵PID:1980
-
C:\Windows\assembly\GAC_32\naphlpr\backup.exeC:\Windows\assembly\GAC_32\naphlpr\backup.exe C:\Windows\assembly\GAC_32\naphlpr\1⤵PID:2888
-
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\1⤵PID:284
-
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\1⤵PID:2776
-
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exeC:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\1⤵PID:548
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1⤵PID:1484
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\update.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\update.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\2⤵PID:2912
-
-
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\data.exe"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\1⤵PID:2764
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\update.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\update.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\1⤵PID:1600
-
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\data.exe"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\1⤵PID:1532
-
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\1⤵PID:3000
-
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\1⤵PID:1276
-
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\1⤵PID:1640
-
C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exeC:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\1⤵PID:2664
-
C:\Windows\assembly\GAC_32\System.EnterpriseServices\update.exeC:\Windows\assembly\GAC_32\System.EnterpriseServices\update.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\1⤵PID:1852
-
C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\2⤵PID:1016
-
-
C:\Windows\assembly\GAC_32\System.Printing\backup.exeC:\Windows\assembly\GAC_32\System.Printing\backup.exe C:\Windows\assembly\GAC_32\System.Printing\1⤵PID:2880
-
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\1⤵PID:1644
-
C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\1⤵PID:2840
-
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\1⤵PID:320
-
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\data.exe"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\2⤵PID:1900
-
-
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\1⤵PID:1808
-
C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\1⤵PID:2764
-
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\1⤵PID:584
-
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\1⤵PID:2836
-
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\data.exeC:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\1⤵PID:2632
-
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\data.exe"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\data.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\1⤵PID:1348
-
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\1⤵PID:2976
-
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\1⤵PID:2044
-
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\1⤵PID:2864
-
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\1⤵PID:2764
-
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\data.exe"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\2⤵PID:1476
-
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\1⤵PID:624
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\1⤵PID:1652
-
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\1⤵PID:2200
-
C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\1⤵PID:2292
-
C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\1⤵PID:3060
-
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\1⤵PID:2524
-
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\1⤵PID:1004
-
C:\Program Files (x86)\Windows Defender\en-US\backup.exe"C:\Program Files (x86)\Windows Defender\en-US\backup.exe" C:\Program Files (x86)\Windows Defender\en-US\1⤵PID:1228
-
C:\Program Files (x86)\Windows Defender\es-ES\backup.exe"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\1⤵PID:572
-
C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\1⤵PID:2624
-
C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\1⤵PID:1300
-
C:\Program Files (x86)\Windows Mail\en-US\backup.exe"C:\Program Files (x86)\Windows Mail\en-US\backup.exe" C:\Program Files (x86)\Windows Mail\en-US\1⤵PID:2324
-
C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\1⤵PID:1900
-
C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe"C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\1⤵PID:2480
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\1⤵PID:3036
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\System Restore.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\2⤵PID:3028
-
-
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\update.exeC:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\1⤵PID:2928
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\1⤵PID:1984
-
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\1⤵PID:2560
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\1⤵PID:1960
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\1⤵PID:1996
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\update.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\2⤵PID:2784
-
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\2⤵PID:1440
-
-
C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\1⤵PID:2448
-
C:\Program Files (x86)\Windows NT\Accessories\backup.exe"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\1⤵PID:584
-
C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe"C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\es-ES\2⤵PID:2528
-
-
C:\Program Files (x86)\Windows NT\Accessories\ja-JP\backup.exe"C:\Program Files (x86)\Windows NT\Accessories\ja-JP\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\ja-JP\2⤵PID:1672
-
-
C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exeC:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\1⤵PID:2440
-
C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exeC:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\1⤵PID:1868
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\1⤵PID:1268
-
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\update.exe"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\2⤵PID:496
-
-
C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\1⤵PID:3064
-
C:\Program Files (x86)\Windows NT\TableTextService\backup.exe"C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\1⤵PID:2560
-
C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe"C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\de-DE\2⤵PID:2968
-
-
C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe"C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\es-ES\2⤵PID:2016
-
-
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\1⤵PID:2712
-
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\2⤵PID:1368
-
-
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exeC:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\1⤵PID:2180
-
C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\1⤵PID:300
-
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exeC:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\1⤵PID:2136
-
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\1⤵PID:2692
-
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\2⤵PID:1420
-
-
C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe"C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\ja-JP\1⤵PID:2928
-
C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\1⤵PID:2624
-
C:\Program Files (x86)\Windows Sidebar\de-DE\backup.exe"C:\Program Files (x86)\Windows Sidebar\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\de-DE\1⤵PID:2068
-
C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe"C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\es-ES\1⤵PID:2940
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\1⤵PID:2272
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\2⤵PID:2792
-
-
C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\1⤵PID:2000
-
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exeC:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\1⤵PID:2732
-
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\update.exeC:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\2⤵PID:1768
-
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\1⤵PID:1228
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\update.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\2⤵PID:2060
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\1⤵PID:444
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\1⤵PID:2708
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\1⤵PID:1648
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\2⤵PID:2820
-
-
C:\Windows\assembly\GAC_MSIL\ehiProxy\update.exeC:\Windows\assembly\GAC_MSIL\ehiProxy\update.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\1⤵PID:3012
-
C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\2⤵PID:2268
-
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\1⤵PID:1500
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\2⤵PID:2424
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\1⤵PID:1840
-
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\data.exe"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\data.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\1⤵PID:1744
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\1⤵PID:2392
-
C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exeC:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\1⤵PID:884
-
C:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exeC:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\1⤵PID:828
-
C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\2⤵PID:2724
-
-
C:\Windows\assembly\GAC_MSIL\ehshell\backup.exeC:\Windows\assembly\GAC_MSIL\ehshell\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\1⤵PID:1504
-
C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\2⤵PID:2504
-
-
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\1⤵PID:2572
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\1⤵PID:1112
-
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\1⤵PID:328
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\1⤵PID:2732
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\2⤵PID:2836
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\1⤵PID:2200
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\1⤵PID:1864
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\2⤵PID:2204
-
-
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\1⤵PID:2524
-
C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exeC:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\1⤵PID:2044
-
C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\2⤵PID:2696
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\1⤵PID:352
-
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\1⤵PID:1148
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\1⤵PID:2808
-
C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\1⤵PID:2556
-
C:\Windows\assembly\GAC_MSIL\IIEHost\backup.exeC:\Windows\assembly\GAC_MSIL\IIEHost\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\1⤵PID:284
-
C:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exeC:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\1⤵PID:2716
-
C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\1⤵PID:2304
-
C:\Windows\assembly\GAC_MSIL\mcepg\backup.exeC:\Windows\assembly\GAC_MSIL\mcepg\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\1⤵PID:784
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\1⤵PID:1800
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\1⤵PID:3032
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\1⤵PID:624
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\2⤵PID:2864
-
-
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\1⤵PID:2816
-
C:\Windows\DigitalLocker\de-DE\System Restore.exe"C:\Windows\DigitalLocker\de-DE\System Restore.exe" C:\Windows\DigitalLocker\de-DE\1⤵PID:2036
-
C:\Windows\DigitalLocker\en-US\update.exeC:\Windows\DigitalLocker\en-US\update.exe C:\Windows\DigitalLocker\en-US\1⤵PID:2796
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\1⤵PID:840
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\1⤵PID:1016
-
C:\Windows\DigitalLocker\fr-FR\backup.exeC:\Windows\DigitalLocker\fr-FR\backup.exe C:\Windows\DigitalLocker\fr-FR\1⤵PID:2204
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\1⤵PID:2932
-
C:\Windows\DigitalLocker\ja-JP\backup.exeC:\Windows\DigitalLocker\ja-JP\backup.exe C:\Windows\DigitalLocker\ja-JP\1⤵PID:2508
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\System Restore.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\1⤵PID:2000
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\1⤵PID:1148
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\1⤵PID:1552
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\1⤵PID:1856
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\2⤵PID:1652
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\2⤵PID:2540
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\update.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\1⤵PID:2704
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\1⤵PID:2304
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\update.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\1⤵PID:920
-
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exeC:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\1⤵PID:1392
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\1⤵PID:2196
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\2⤵PID:2620
-
-
C:\Windows\ehome\MCX\X02\backup.exeC:\Windows\ehome\MCX\X02\backup.exe C:\Windows\ehome\MCX\X02\1⤵PID:2820
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\1⤵PID:2416
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\1⤵PID:2616
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\2⤵PID:1660
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1⤵PID:2652
-
C:\Windows\ehome\wow\ja-JP\backup.exeC:\Windows\ehome\wow\ja-JP\backup.exe C:\Windows\ehome\wow\ja-JP\1⤵PID:2580
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\1⤵PID:2720
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\1⤵PID:1988
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\1⤵PID:844
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\1⤵PID:2592
-
C:\Windows\Globalization\ELS\backup.exeC:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\1⤵PID:1784
-
C:\Windows\Globalization\ELS\Transliteration\backup.exeC:\Windows\Globalization\ELS\Transliteration\backup.exe C:\Windows\Globalization\ELS\Transliteration\2⤵PID:2648
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\1⤵PID:2872
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\1⤵PID:1300
-
C:\Windows\Help\Help\backup.exeC:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\1⤵PID:872
-
C:\Windows\Help\Help\de-DE\backup.exeC:\Windows\Help\Help\de-DE\backup.exe C:\Windows\Help\Help\de-DE\2⤵PID:1904
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\1⤵PID:444
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\1⤵PID:2844
-
C:\Windows\Help\mui\0407\backup.exeC:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\1⤵PID:2444
-
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\1⤵PID:2112
-
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\1⤵PID:2560
-
C:\Windows\Help\mui\0C0A\backup.exeC:\Windows\Help\mui\0C0A\backup.exe C:\Windows\Help\mui\0C0A\1⤵PID:2296
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\1⤵PID:2264
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\1⤵PID:2496
-
C:\Windows\Help\Windows\de-DE\System Restore.exe"C:\Windows\Help\Windows\de-DE\System Restore.exe" C:\Windows\Help\Windows\de-DE\1⤵PID:864
-
C:\Windows\Help\Windows\en-US\update.exeC:\Windows\Help\Windows\en-US\update.exe C:\Windows\Help\Windows\en-US\1⤵PID:328
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\1⤵PID:1620
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\1⤵PID:2600
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\2⤵PID:2220
-
-
C:\Windows\IME\IMEJP10\DICTS\backup.exeC:\Windows\IME\IMEJP10\DICTS\backup.exe C:\Windows\IME\IMEJP10\DICTS\1⤵PID:3016
-
C:\Windows\IME\imekr8\dicts\backup.exeC:\Windows\IME\imekr8\dicts\backup.exe C:\Windows\IME\imekr8\dicts\1⤵PID:1608
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\1⤵PID:1584
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\1⤵PID:2464
-
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\1⤵PID:2312
-
C:\Windows\IME\ja-JP\backup.exeC:\Windows\IME\ja-JP\backup.exe C:\Windows\IME\ja-JP\1⤵PID:2668
-
C:\Windows\inf\ASP.NET\backup.exeC:\Windows\inf\ASP.NET\backup.exe C:\Windows\inf\ASP.NET\1⤵PID:1948
-
C:\Windows\inf\ASP.NET\0001\backup.exeC:\Windows\inf\ASP.NET\0001\backup.exe C:\Windows\inf\ASP.NET\0001\2⤵PID:2136
-
-
C:\Windows\inf\ASP.NET\0006\backup.exeC:\Windows\inf\ASP.NET\0006\backup.exe C:\Windows\inf\ASP.NET\0006\2⤵PID:3068
-
-
C:\Windows\inf\ASP.NET\000B\backup.exeC:\Windows\inf\ASP.NET\000B\backup.exe C:\Windows\inf\ASP.NET\000B\2⤵PID:2928
-
-
C:\Windows\inf\ASP.NET\0010\System Restore.exe"C:\Windows\inf\ASP.NET\0010\System Restore.exe" C:\Windows\inf\ASP.NET\0010\2⤵PID:2920
-
-
C:\Windows\inf\ASP.NET\0019\backup.exeC:\Windows\inf\ASP.NET\0019\backup.exe C:\Windows\inf\ASP.NET\0019\2⤵PID:1740
-
-
C:\Windows\inf\ASP.NET\001D\backup.exeC:\Windows\inf\ASP.NET\001D\backup.exe C:\Windows\inf\ASP.NET\001D\2⤵PID:1804
-
-
C:\Windows\inf\ASP.NET\0416\backup.exeC:\Windows\inf\ASP.NET\0416\backup.exe C:\Windows\inf\ASP.NET\0416\2⤵PID:2084
-
-
C:\Windows\inf\ASP.NET\0816\backup.exeC:\Windows\inf\ASP.NET\0816\backup.exe C:\Windows\inf\ASP.NET\0816\2⤵PID:2648
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\1⤵PID:1420
-
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\1⤵PID:1784
-
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\data.exeC:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\1⤵PID:2600
-
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\1⤵PID:1484
-
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\2⤵PID:612
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\1⤵PID:2676
-
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\1⤵PID:1292
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\1⤵PID:2108
-
C:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0000\1⤵PID:604
-
C:\Windows\inf\ASP.NET_4.0.30319\0001\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\0001\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0001\1⤵PID:1660
-
C:\Windows\inf\ASP.NET_4.0.30319\0006\data.exeC:\Windows\inf\ASP.NET_4.0.30319\0006\data.exe C:\Windows\inf\ASP.NET_4.0.30319\0006\1⤵PID:2768
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\1⤵PID:2296
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\1⤵PID:2292
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\2⤵PID:1644
-
-
C:\Windows\inf\ASP.NET_4.0.30319\000C\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\000C\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000C\1⤵PID:2336
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\1⤵PID:1632
-
C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\1⤵PID:1420
-
C:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0011\1⤵PID:2204
-
C:\Windows\inf\ASP.NET_4.0.30319\001D\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\001D\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\001D\1⤵PID:496
-
C:\Windows\inf\ASP.NET_4.0.30319\001F\System Restore.exe"C:\Windows\inf\ASP.NET_4.0.30319\001F\System Restore.exe" C:\Windows\inf\ASP.NET_4.0.30319\001F\1⤵PID:2868
-
C:\Windows\inf\ASP.NET_4.0.30319\0816\backup.exeC:\Windows\inf\ASP.NET_4.0.30319\0816\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0816\1⤵PID:2264
-
C:\Windows\inf\aspnet_state\backup.exeC:\Windows\inf\aspnet_state\backup.exe C:\Windows\inf\aspnet_state\1⤵PID:2712
-
C:\Windows\inf\aspnet_state\0001\backup.exeC:\Windows\inf\aspnet_state\0001\backup.exe C:\Windows\inf\aspnet_state\0001\2⤵PID:2640
-
-
C:\Windows\inf\aspnet_state\0007\backup.exeC:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\2⤵PID:2800
-
-
C:\Windows\inf\aspnet_state\0008\backup.exeC:\Windows\inf\aspnet_state\0008\backup.exe C:\Windows\inf\aspnet_state\0008\2⤵PID:2760
-
-
C:\Windows\inf\aspnet_state\000B\backup.exeC:\Windows\inf\aspnet_state\000B\backup.exe C:\Windows\inf\aspnet_state\000B\2⤵PID:2220
-
-
C:\Windows\inf\aspnet_state\000C\backup.exeC:\Windows\inf\aspnet_state\000C\backup.exe C:\Windows\inf\aspnet_state\000C\2⤵PID:2268
-
-
C:\Windows\inf\aspnet_state\000E\backup.exeC:\Windows\inf\aspnet_state\000E\backup.exe C:\Windows\inf\aspnet_state\000E\2⤵PID:2228
-
-
C:\Windows\inf\aspnet_state\0013\update.exeC:\Windows\inf\aspnet_state\0013\update.exe C:\Windows\inf\aspnet_state\0013\2⤵PID:2664
-
-
C:\Windows\inf\aspnet_state\001D\backup.exeC:\Windows\inf\aspnet_state\001D\backup.exe C:\Windows\inf\aspnet_state\001D\2⤵PID:3004
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\1⤵PID:1624
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\1⤵PID:884
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\1⤵PID:2524
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\1⤵PID:536
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\1⤵PID:2432
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\1⤵PID:2652
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\1⤵PID:1660
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\1⤵PID:1520
-
C:\Windows\inf\BITS\0409\backup.exeC:\Windows\inf\BITS\0409\backup.exe C:\Windows\inf\BITS\0409\1⤵PID:2860
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\1⤵PID:2656
-
C:\Windows\inf\BITS\040C\backup.exeC:\Windows\inf\BITS\040C\backup.exe C:\Windows\inf\BITS\040C\1⤵PID:2556
-
C:\Windows\inf\BITS\0411\backup.exeC:\Windows\inf\BITS\0411\backup.exe C:\Windows\inf\BITS\0411\1⤵PID:3000
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\1⤵PID:2868
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\1⤵PID:2604
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\1⤵PID:1276
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\1⤵PID:2024
-
C:\Windows\inf\ESENT\0410\backup.exeC:\Windows\inf\ESENT\0410\backup.exe C:\Windows\inf\ESENT\0410\1⤵PID:3064
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\1⤵PID:1876
-
C:\Windows\inf\MSDTC\backup.exeC:\Windows\inf\MSDTC\backup.exe C:\Windows\inf\MSDTC\1⤵PID:2368
-
C:\Windows\inf\MSDTC\0000\backup.exeC:\Windows\inf\MSDTC\0000\backup.exe C:\Windows\inf\MSDTC\0000\2⤵PID:2560
-
-
C:\Windows\inf\MSDTC\0409\backup.exeC:\Windows\inf\MSDTC\0409\backup.exe C:\Windows\inf\MSDTC\0409\2⤵PID:1788
-
-
C:\Windows\inf\MSDTC\0410\backup.exeC:\Windows\inf\MSDTC\0410\backup.exe C:\Windows\inf\MSDTC\0410\2⤵PID:3052
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\1⤵PID:2520
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1⤵PID:952
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\2⤵PID:976
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\1⤵PID:1244
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1⤵PID:2180
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\2⤵PID:2092
-
-
C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\1⤵PID:3032
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\1⤵PID:780
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\1⤵PID:1952
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\1⤵PID:3016
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\1⤵PID:2684
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1⤵PID:2968
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1⤵PID:2504
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\1⤵PID:2552
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\1⤵PID:268
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\1⤵PID:1608
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\1⤵PID:2608
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\1⤵PID:1976
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\1⤵PID:2616
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\1⤵PID:2980
-
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\1⤵PID:2108
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\1⤵PID:372
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\1⤵PID:1772
-
C:\Windows\inf\PERFLIB\backup.exeC:\Windows\inf\PERFLIB\backup.exe C:\Windows\inf\PERFLIB\1⤵PID:1112
-
C:\Windows\inf\PERFLIB\0000\backup.exeC:\Windows\inf\PERFLIB\0000\backup.exe C:\Windows\inf\PERFLIB\0000\2⤵PID:2920
-
-
C:\Windows\inf\PERFLIB\0407\backup.exeC:\Windows\inf\PERFLIB\0407\backup.exe C:\Windows\inf\PERFLIB\0407\2⤵PID:2784
-
-
C:\Windows\inf\PERFLIB\0409\backup.exeC:\Windows\inf\PERFLIB\0409\backup.exe C:\Windows\inf\PERFLIB\0409\2⤵PID:2604
-
-
C:\Windows\inf\PERFLIB\040C\backup.exeC:\Windows\inf\PERFLIB\040C\backup.exe C:\Windows\inf\PERFLIB\040C\2⤵PID:540
-
-
C:\Windows\inf\PERFLIB\0410\backup.exeC:\Windows\inf\PERFLIB\0410\backup.exe C:\Windows\inf\PERFLIB\0410\2⤵PID:1300
-
-
C:\Windows\inf\PERFLIB\0411\backup.exeC:\Windows\inf\PERFLIB\0411\backup.exe C:\Windows\inf\PERFLIB\0411\2⤵PID:2644
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\1⤵PID:2620
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\1⤵PID:2628
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\1⤵PID:2836
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\1⤵PID:2584
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\1⤵PID:1800
-
C:\Windows\inf\rdyboost\0409\backup.exeC:\Windows\inf\rdyboost\0409\backup.exe C:\Windows\inf\rdyboost\0409\1⤵PID:1600
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1⤵PID:3016
-
C:\Windows\inf\rdyboost\0410\data.exeC:\Windows\inf\rdyboost\0410\data.exe C:\Windows\inf\rdyboost\0410\1⤵PID:1440
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\1⤵PID:2500
-
C:\Windows\inf\rdyboost\0411\backup.exeC:\Windows\inf\rdyboost\0411\backup.exe C:\Windows\inf\rdyboost\0411\1⤵PID:1988
-
C:\Windows\inf\rdyboost\0C0A\backup.exeC:\Windows\inf\rdyboost\0C0A\backup.exe C:\Windows\inf\rdyboost\0C0A\1⤵PID:1068
-
C:\Windows\inf\RemoteAccess\0000\backup.exeC:\Windows\inf\RemoteAccess\0000\backup.exe C:\Windows\inf\RemoteAccess\0000\1⤵PID:1420
-
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\1⤵PID:1856
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\update.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\1⤵PID:604
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\f783ac27ea23c446829dc6e52eba8bcf\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\f783ac27ea23c446829dc6e52eba8bcf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\f783ac27ea23c446829dc6e52eba8bcf\1⤵PID:2488
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\1⤵PID:2496
-
C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\1⤵PID:3032
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\1⤵PID:1868
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\1⤵PID:2420
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\1⤵PID:2556
-
C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe"C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\1⤵PID:1652
-
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\data.exe"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\data.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\2⤵PID:1516
-
-
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0407\2⤵PID:788
-
-
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\2⤵PID:2520
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\1⤵PID:2696
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\1⤵PID:2744
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\1⤵PID:1492
-
C:\Windows\inf\ServiceModelService 3.0.0.0\backup.exe"C:\Windows\inf\ServiceModelService 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\1⤵PID:3060
-
C:\Windows\inf\ServiceModelService 3.0.0.0\0409\backup.exe"C:\Windows\inf\ServiceModelService 3.0.0.0\0409\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0409\2⤵PID:1568
-
-
C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe"C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\2⤵PID:2860
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\1⤵PID:1560
-
C:\Windows\inf\SMSvcHost 3.0.0.0\0000\backup.exe"C:\Windows\inf\SMSvcHost 3.0.0.0\0000\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0000\1⤵PID:2104
-
C:\Windows\inf\SMSvcHost 3.0.0.0\0410\backup.exe"C:\Windows\inf\SMSvcHost 3.0.0.0\0410\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0410\1⤵PID:2596
-
C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000B\1⤵PID:2276
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\1⤵PID:1048
-
C:\Windows\inf\SMSvcHost 4.0.0.0\000D\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\000D\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000D\1⤵PID:2740
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\6d4bacfd54e8f79763945bee5a50711d\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\6d4bacfd54e8f79763945bee5a50711d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\6d4bacfd54e8f79763945bee5a50711d\1⤵PID:548
-
C:\Windows\inf\SMSvcHost 4.0.0.0\0010\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\0010\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0010\1⤵PID:784
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\1⤵PID:2744
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\2⤵PID:3000
-
-
C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0014\1⤵PID:1668
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\1⤵PID:2116
-
C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0804\1⤵PID:2080
-
C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe"C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0816\1⤵PID:2644
-
C:\Windows\inf\TAPISRV\backup.exeC:\Windows\inf\TAPISRV\backup.exe C:\Windows\inf\TAPISRV\1⤵PID:2132
-
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_it_b03f5f7f11d50a3a\1⤵PID:1568
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\1⤵PID:2584
-
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\1⤵PID:2928
-
C:\Windows\inf\UGatherer\0000\backup.exeC:\Windows\inf\UGatherer\0000\backup.exe C:\Windows\inf\UGatherer\0000\1⤵PID:1808
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\1⤵PID:2880
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\1⤵PID:1684
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\1⤵PID:2968
-
C:\Windows\inf\UGTHRSVC\040C\backup.exeC:\Windows\inf\UGTHRSVC\040C\backup.exe C:\Windows\inf\UGTHRSVC\040C\1⤵PID:2420
-
C:\Windows\inf\UGTHRSVC\0410\backup.exeC:\Windows\inf\UGTHRSVC\0410\backup.exe C:\Windows\inf\UGTHRSVC\0410\1⤵PID:2764
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\8218dc4808b77f3585fb048c61597af1\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\8218dc4808b77f3585fb048c61597af1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\8218dc4808b77f3585fb048c61597af1\1⤵PID:2932
-
C:\Windows\inf\usbhub\backup.exeC:\Windows\inf\usbhub\backup.exe C:\Windows\inf\usbhub\1⤵PID:1072
-
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\1⤵PID:1648
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\1⤵PID:2444
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\1⤵PID:2896
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\2⤵PID:2528
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\2⤵PID:2552
-
-
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\backup.exe"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\1⤵PID:2300
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\1⤵PID:2488
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\1⤵PID:1952
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\update.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\1⤵PID:2928
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\1⤵PID:2596
-
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\1⤵PID:1492
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\1⤵PID:760
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\backup.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\2⤵PID:2384
-
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\backup.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\2⤵PID:1972
-
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0010\backup.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0010\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0010\2⤵PID:2920
-
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0013\data.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0013\data.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0013\2⤵PID:1952
-
-
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\2⤵PID:1320
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\update.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\1⤵PID:2164
-
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\1⤵PID:2744
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\1⤵PID:1688
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\1⤵PID:1864
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\1⤵PID:624
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\2⤵PID:2548
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\1⤵PID:2092
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\1⤵PID:2204
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\1⤵PID:2976
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\2⤵PID:468
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\1⤵PID:1904
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\2⤵PID:1792
-
-
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\1⤵PID:1952
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\1⤵PID:1868
-
C:\Windows\inf\WmiApRpl\backup.exeC:\Windows\inf\WmiApRpl\backup.exe C:\Windows\inf\WmiApRpl\1⤵PID:2928
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\1⤵PID:300
-
C:\Windows\inf\wsearchidxpi\update.exeC:\Windows\inf\wsearchidxpi\update.exe C:\Windows\inf\wsearchidxpi\1⤵PID:2952
-
C:\Windows\inf\wsearchidxpi\0000\backup.exeC:\Windows\inf\wsearchidxpi\0000\backup.exe C:\Windows\inf\wsearchidxpi\0000\2⤵PID:1684
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\1⤵PID:2592
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\1⤵PID:2428
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\fac6392e83ef7e777b78933e057c9546\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\fac6392e83ef7e777b78933e057c9546\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\fac6392e83ef7e777b78933e057c9546\1⤵PID:1788
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\1⤵PID:2840
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\2⤵PID:1568
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\1⤵PID:3052
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\5490e4be56d6b1a80586439ac8b09b77\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\5490e4be56d6b1a80586439ac8b09b77\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\5490e4be56d6b1a80586439ac8b09b77\1⤵PID:2956
-
C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:648
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiBmlDataCarousel\1⤵PID:2692
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\1⤵PID:1980
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\2⤵PID:2100
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\1⤵PID:320
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\1⤵PID:2600
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\1⤵PID:2296
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\update.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\2⤵PID:2144
-
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\1⤵PID:1652
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\update.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\2⤵PID:2820
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\4a7ec1155d9e9e4b40889b171d16a577\1⤵PID:1520
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\1⤵PID:1088
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\1⤵PID:2440
-
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\2⤵PID:2628
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\1⤵PID:2844
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\1⤵PID:2564
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\32c163c5b3420fb95f4bc8b5a365a6bd\2⤵PID:2460
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\1⤵PID:976
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\1⤵PID:2312
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\2⤵PID:1760
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\1⤵PID:2176
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\2⤵PID:548
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\2⤵PID:1760
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\2⤵PID:2928
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\2⤵PID:2956
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\2⤵PID:2040
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\3⤵PID:2840
-
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\2⤵PID:1308
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\1⤵PID:2520
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\1⤵PID:2672
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\1⤵PID:1804
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\2⤵PID:2820
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\1⤵PID:2428
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\1⤵PID:2744
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\2⤵PID:2768
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\1⤵PID:2036
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\2⤵PID:604
-
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:2472
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\1⤵PID:2092
-
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\1⤵PID:2664
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\1⤵PID:2996
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\1⤵PID:2264
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\1⤵PID:2704
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Speech\6935e1dad6ec5de21658f8d38999099a\1⤵PID:2080
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\1⤵PID:1952
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\1⤵PID:1496
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\1⤵PID:784
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\1⤵PID:2792
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\data.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\1⤵PID:2840
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\a16dd65d2bfab6a019ac8a05337a5c24\1⤵PID:2224
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\1⤵PID:2304
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\1⤵PID:1740
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\1⤵PID:696
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\1⤵PID:2264
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\1⤵PID:2880
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\2⤵PID:632
-
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_de_31bf3856ad364e35\1⤵PID:2644
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\1⤵PID:2592
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\1⤵PID:1584
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\System Restore.exe"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\165d0873203da280298bfcfa50567a0b\1⤵PID:2304
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\89815091ad8cb6d7b4c48d84ff1021e0\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\89815091ad8cb6d7b4c48d84ff1021e0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\89815091ad8cb6d7b4c48d84ff1021e0\1⤵PID:2668
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\1⤵PID:2656
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\1⤵PID:2916
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\fee2bbfe0b8f5988a3ab7a9db85c7a30\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\fee2bbfe0b8f5988a3ab7a9db85c7a30\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\fee2bbfe0b8f5988a3ab7a9db85c7a30\1⤵PID:2104
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Uti#\8ce46e3ffce2d37b9c50762a641c57ee\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Uti#\8ce46e3ffce2d37b9c50762a641c57ee\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Uti#\8ce46e3ffce2d37b9c50762a641c57ee\1⤵PID:1140
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\b2a2c534c407bbe46e8536445d0ada50\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\b2a2c534c407bbe46e8536445d0ada50\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\b2a2c534c407bbe46e8536445d0ada50\1⤵PID:2296
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\06d363f8e85281d0f70f2c88d1a0e667\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\06d363f8e85281d0f70f2c88d1a0e667\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\06d363f8e85281d0f70f2c88d1a0e667\1⤵PID:416
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:2560
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:2840
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\1⤵PID:2540
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:1840
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\1⤵PID:2716
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\140714964f3afbcea38cb33d548c5d3c\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\140714964f3afbcea38cb33d548c5d3c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\140714964f3afbcea38cb33d548c5d3c\1⤵PID:2932
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:444
-
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\data.exeC:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_es_31bf3856ad364e35\1⤵PID:2060
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\b883b83d1f72f1fcaf4acdef3c9c381f\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\b883b83d1f72f1fcaf4acdef3c9c381f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\b883b83d1f72f1fcaf4acdef3c9c381f\1⤵PID:1956
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1⤵PID:1632
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\f1f58d6720098d7c1d51faf7f326d72d\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\f1f58d6720098d7c1d51faf7f326d72d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\f1f58d6720098d7c1d51faf7f326d72d\1⤵PID:2144
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7a9c26f21641112fcacd6f087b42133a\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7a9c26f21641112fcacd6f087b42133a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7a9c26f21641112fcacd6f087b42133a\1⤵PID:548
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\1⤵PID:2512
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\1⤵PID:1300
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\1⤵PID:2592
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\data.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\1⤵PID:1836
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\1⤵PID:1976
-
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\backup.exeC:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1⤵PID:2236
-
C:\Windows\assembly\GAC_MSIL\MiguiControls\System Restore.exe"C:\Windows\assembly\GAC_MSIL\MiguiControls\System Restore.exe" C:\Windows\assembly\GAC_MSIL\MiguiControls\1⤵PID:1632
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\789d8b780d7bbfb6ceccd2ccea85f364\System Restore.exe"C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\789d8b780d7bbfb6ceccd2ccea85f364\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\789d8b780d7bbfb6ceccd2ccea85f364\1⤵PID:1492
-
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\1⤵PID:2740
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Transacti#\a04be0cabc675da23c6cdd970b50e3c5\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Transacti#\a04be0cabc675da23c6cdd970b50e3c5\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Transacti#\a04be0cabc675da23c6cdd970b50e3c5\1⤵PID:2044
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\1⤵PID:2268
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\684eae3bcd28cb6d1e6997e6497056e2\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\684eae3bcd28cb6d1e6997e6497056e2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\684eae3bcd28cb6d1e6997e6497056e2\2⤵PID:2644
-
-
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\1⤵PID:948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5718e1b5d475985151c3983f7401f0ced
SHA1361c0bbd155b4d730bcb8c50119edb0b85014276
SHA2564f656dc4d13eccd5700942afd3071e93b57c0823d0fa48dbbf0a8128dc0f4117
SHA51238de1a972d304cee4a007651e1f7e1f65ddd921373755d6334bf70aec031c9a630fa6453c988bc0dbc0fc76840cab320caec2c80024ed5b8b2e2db5ffc947a42
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
72KB
MD516379cf9cf7f4984d633928f817903ac
SHA1a61add64ab6df2c7129a86747f60bfbfd03d71a4
SHA2560faab4aad211deec70c6b64e8b25ad59917d005ffdd5b4dc1972e58d5bf31146
SHA512f56196b399a05b0995579fb9b2ecf95cbc6d3eb246e367cfbde47b81cb73c8ee25e61f6060afdedb6b780adb01e34134a9bf569639624887b2a95935acf18a46
-
Filesize
72KB
MD588c00e8939e16f56e8d9cc0b4d3f896e
SHA1910a963d975e0fbd521b775c94c885672348780a
SHA2564da39b1316bd7d82a063833ee95fecbf28e68861fd95c2b3a11b0e65ccb49a58
SHA512e81da4ef0a108d96fc4893e5f917cc3321eb0202fbd9b8e8c2b18154398e91cb2a0e2052bc0fa1de93d5c6a654a2893a486185c1f8bb944b49af24b173d224e0
-
Filesize
72KB
MD5a6524d265ac64379abf26cf4db268a63
SHA19c144d6571a53bc9139c9a601cd93689255d369a
SHA256fa49179a039e85a0b78b54a4fc52629082f482f8fad4af1cdb33d55ffc811f27
SHA5123945990fe3dbd02db295ba10972f10d97379dd78046e92297f14290b0e05521ef896f8a39a0341b3a2e89b280cde914dff29fff923b76999e8fc6ae327f15494
-
Filesize
72KB
MD5f6bfa56df0876faa6b5f95bab7bca475
SHA166a393b4146337e22a13876e68eebed08db99874
SHA2561bc1282a2a74f5c484f695ed210a565fa5430185e4f57bc8ebaf7932cec2c857
SHA5126a030ef1ce35a9d46cc75ec53c9d3f101eda76a71497b5fd6c9fc56fdc05cbdca4439e9b5eeef3afe095bf18041f936ee6b6ea181f8649db8ed0faf41a279241
-
Filesize
72KB
MD53486787d436bf453520b1f0364e28b3c
SHA1034a535571dfbb738587fbafa8101625596881cf
SHA25631ea782201da1465013dbc348494d79f8b53ae08e21190c87a550a680419b01c
SHA512942a01943b296034d7ff18406125e71aa5b3acdec5a25dfb0020f8de0eec6d9c33a1dcf2008bc944e98317a617d3fdf4da51c791850d4116e5e46e198f9bfbc2
-
Filesize
72KB
MD5dc52ed06ff687c117ccf91791525ea26
SHA19bd34ccdbc89ac8e243ce1294359b37a64d9c97b
SHA2564e14a0e9d7ea6aa9f354e2c97bf722d58f00ebec4a45bb83eefa4ac046890621
SHA512e88309a27350fdd45dabbd01d8db8f6d7a08a4592a3ea45b030a8c35570efa9cdcc2cbd0f39a7a63efe262718f6ba207275400e811ee32699c2e2d79fb441cbd
-
Filesize
72KB
MD5c01bbd1740a92ecc9837db463bda88e4
SHA137feb3156a3136b73550c628a1d4ab9782f2d1e1
SHA2569280f0019159c8afdda61c82f3dcf42cb8d43887b07957842bab352d5002e63e
SHA5126fdf4bbe0812fdd3dde1897e0bc925e7c5cb2f7481314f1400b4e16b4e5786b18542883c5776a1ef59a2106887358165fe5287d5185b3174e16ec08c7e32315d