077b01f89d9cd1f419987b41635de17674dc77e7ca4701b8d58b68426d1612a2

Analysis

max time kernel
74s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077b01f89d9cd1f419987b41635de17674dc77e7ca4701b8d58b68426d1612a2.exe
Size

72KB
MD5

8957a2f4af2c477a265f96bcddb4cef0
SHA1

8cd619691b479ff3f429473ce099e089e356e895
SHA256

077b01f89d9cd1f419987b41635de17674dc77e7ca4701b8d58b68426d1612a2
SHA512

0877aecbfe8d2599204a509ae47156daffbf768738e267831876e122c340a2e59fe4cc2f4aa9604317fb9a8df1e38a51847eb0760f59a45d03d8bbf1b5032fa7
SSDEEP

384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2N:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrx

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\077b01f89d9cd1f419987b41635de17674dc77e7ca4701b8d58b68426d1612a2.exe
"C:\Users\Admin\AppData\Local\Temp\077b01f89d9cd1f419987b41635de17674dc77e7ca4701b8d58b68426d1612a2.exe"
1⤵
PID:3068
- C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\backup.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\
  2⤵
  PID:356
- - C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\backup.exe
    C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\
    3⤵
    PID:1212
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2648

C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_2049673321\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_2049673321\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_2049673321\CRX_INSTALL\
1⤵
PID:2864

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
1⤵
PID:1408

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
1⤵
PID:1752
- C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
  2⤵
  PID:2256
- C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
  2⤵
  PID:1800
- C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
  2⤵
  PID:1068
- C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
  2⤵
  PID:1684
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:1460
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
  2⤵
  PID:2152
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
    3⤵
    PID:2800
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
    3⤵
    PID:2652
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
    3⤵
    PID:2492
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
    3⤵
    PID:1640
- C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
  2⤵
  PID:2440
- C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
  2⤵
  PID:2480
- C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:2584
- C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
  2⤵
  PID:1016
- C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
  2⤵
  PID:1224
- C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
  2⤵
  PID:2344
- C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
  2⤵
  PID:2728
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
  2⤵
  PID:2016
- C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
  2⤵
  PID:2888
- C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
  2⤵
  PID:692
- C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
  2⤵
  PID:588
- C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
  2⤵
  PID:696
- C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
  2⤵
  PID:2816
- C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
  2⤵
  PID:352
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
  2⤵
  PID:976
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
  2⤵
  PID:2844

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:604
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:1748
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:2828
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:1628
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:1532

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:2368
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2576

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2428

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:2692

C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2120
- C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
  2⤵
  PID:2588
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:1916
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:2088
- C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
  2⤵
  PID:1852
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:1508
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:1184

C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2408
- C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
  2⤵
  PID:2176
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:892
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:2708
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:1804
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:1360
- C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
  2⤵
  PID:1512

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:844

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:1148

C:\Program Files\Common Files\Microsoft Shared\VSTO\data.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2752
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
  2⤵
  PID:1572
- - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
    3⤵
    PID:1568

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:668

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:1412
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:2720

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:1408
- C:\Program Files\Common Files\System\ado\backup.exe
  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:1700
- - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
    3⤵
    PID:1204
- - C:\Program Files\Common Files\System\ado\en-US\backup.exe
    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
    3⤵
    PID:2024
- - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
    3⤵
    PID:1704
- - C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
    3⤵
    PID:1904
- - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
    3⤵
    PID:352
- - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
    3⤵
    PID:976
- C:\Program Files\Common Files\System\de-DE\backup.exe
  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:312
- C:\Program Files\Common Files\System\en-US\backup.exe
  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:2124
- C:\Program Files\Common Files\System\es-ES\data.exe
  "C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\
  2⤵
  PID:1748
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:2828
- C:\Program Files\Common Files\System\it-IT\backup.exe
  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
  2⤵
  PID:1708
- C:\Program Files\Common Files\System\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
  2⤵
  PID:1856
- C:\Program Files\Common Files\System\msadc\backup.exe
  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
  2⤵
  PID:1628
- - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
    3⤵
    PID:1532
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:3044
- - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
    3⤵
    PID:2576
- - C:\Program Files\Common Files\System\msadc\fr-FR\update.exe
    "C:\Program Files\Common Files\System\msadc\fr-FR\update.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
    3⤵
    PID:2676
- - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
    "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
    3⤵
    PID:2772
- - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
    3⤵
    PID:2468
- C:\Program Files\Common Files\System\Ole DB\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
  2⤵
  PID:2568
- - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
    3⤵
    PID:2540
- - C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
    3⤵
    PID:2612
- - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:2444
- - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
    3⤵
    PID:2396
- - C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
    3⤵
    PID:356
- - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:2156

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:548
- C:\Program Files\DVD Maker\de-DE\backup.exe
  "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
  2⤵
  PID:892
- C:\Program Files\DVD Maker\en-US\backup.exe
  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
  2⤵
  PID:1796
- C:\Program Files\DVD Maker\es-ES\backup.exe
  "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
  2⤵
  PID:1584
- C:\Program Files\DVD Maker\fr-FR\backup.exe
  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
  2⤵
  PID:1360
- C:\Program Files\DVD Maker\it-IT\backup.exe
  "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
  2⤵
  PID:1512
- C:\Program Files\DVD Maker\ja-JP\backup.exe
  "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
  2⤵
  PID:2032
- C:\Program Files\DVD Maker\Shared\backup.exe
  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
  2⤵
  PID:2760
- - C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
    3⤵
    PID:2052
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
      4⤵
      PID:1944
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
      4⤵
      PID:1572
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
      4⤵
      PID:488
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
      4⤵
      PID:948
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\System Restore.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
      4⤵
      PID:2460
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
      4⤵
      PID:1844
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
      4⤵
      PID:1100
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
      4⤵
      PID:1204
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
      4⤵
      PID:2024
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
      4⤵
      PID:1652
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
      4⤵
      PID:1904
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
      4⤵
      PID:352
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
      4⤵
      PID:976
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
      4⤵
      PID:3048
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\System Restore.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
      4⤵
      PID:2856
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
      4⤵
      PID:2940
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\update.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
      4⤵
      PID:888
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\update.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
      4⤵
      PID:2380
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
      4⤵
      PID:1936
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
      4⤵
      PID:2960

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2564
- C:\Program Files\Google\Chrome\backup.exe
  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
  2⤵
  PID:2604
- - C:\Program Files\Google\Chrome\Application\backup.exe
    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
    3⤵
    PID:2800
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
      4⤵
      PID:2732
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
        5⤵
        
        PID:2204
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
        5⤵
        
        PID:2608
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
        5⤵
        
        PID:2924
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
        5⤵
        
        PID:2472
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
        5⤵
        
        PID:2140
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
        5⤵
        
        PID:2420
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
        5⤵
        
        PID:2308
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
        6⤵
        
        PID:2456
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
        7⤵
        
        PID:2452
  - - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
      4⤵
      PID:2496

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2860
- C:\Program Files\Internet Explorer\de-DE\backup.exe
  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
  2⤵
  PID:2600
- C:\Program Files\Internet Explorer\en-US\backup.exe
  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
  2⤵
  PID:2352
- C:\Program Files\Internet Explorer\es-ES\backup.exe
  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
  2⤵
  PID:2300
- C:\Program Files\Internet Explorer\fr-FR\backup.exe
  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
  2⤵
  PID:1908
- C:\Program Files\Internet Explorer\images\backup.exe
  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
  2⤵
  PID:1236
- C:\Program Files\Internet Explorer\it-IT\data.exe
  "C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\
  2⤵
  PID:2028
- C:\Program Files\Internet Explorer\ja-JP\backup.exe
  "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
  2⤵
  PID:1740
- C:\Program Files\Internet Explorer\SIGNUP\data.exe
  "C:\Program Files\Internet Explorer\SIGNUP\data.exe" C:\Program Files\Internet Explorer\SIGNUP\
  2⤵
  PID:2016

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:1424
- C:\Program Files\Java\jdk1.7.0_80\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
  2⤵
  PID:1216
- - C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
    3⤵
    PID:2712
- - C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
    3⤵
    PID:1788
- - C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
    3⤵
    PID:2796
  - - C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
      4⤵
      PID:1476
- - C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
    3⤵
    PID:816
  - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
      4⤵
      PID:1800
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
        5⤵
        
        PID:2184
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
        5⤵
        
        PID:2844
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
        5⤵
        
        PID:3056
- - C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
    3⤵
    PID:472
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\update.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
      4⤵
      PID:2440
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
        5⤵
        
        PID:2732
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
        5⤵
        
        PID:1760
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
        6⤵
        
        PID:2656
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
        7⤵
        
        PID:2708
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
        7⤵
        
        PID:1364
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
        6⤵
        
        PID:2148
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
        7⤵
        
        PID:2100
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
        6⤵
        
        PID:1872
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
        7⤵
        
        PID:1908
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
        6⤵
        
        PID:2060
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
        7⤵
        
        PID:1456
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
        8⤵
        
        PID:2644
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
        7⤵
        
        PID:1876
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
        6⤵
        
        PID:776
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
        5⤵
        
        PID:2720
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
        6⤵
        
        PID:2516
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
        7⤵
        
        PID:692
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
        6⤵
        
        PID:1100
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
        7⤵
        
        PID:1048
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
        8⤵
        
        PID:1944
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
        9⤵
        
        PID:2256
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
        8⤵
        
        PID:872
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
        9⤵
        
        PID:976
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
        6⤵
        
        PID:352
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\update.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
        7⤵
        
        PID:2280
- C:\Program Files\Java\jre7\backup.exe
  "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
  2⤵
  PID:2672
- - C:\Program Files\Java\jre7\bin\backup.exe
    "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
    3⤵
    PID:2788
  - - C:\Program Files\Java\jre7\bin\dtplugin\update.exe
      "C:\Program Files\Java\jre7\bin\dtplugin\update.exe" C:\Program Files\Java\jre7\bin\dtplugin\
      4⤵
      PID:2864
  - - C:\Program Files\Java\jre7\bin\server\backup.exe
      "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
      4⤵
      PID:356
- - C:\Program Files\Java\jre7\lib\backup.exe
    "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
    3⤵
    PID:2156
  - - C:\Program Files\Java\jre7\lib\amd64\backup.exe
      "C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
      4⤵
      PID:2488
  - - C:\Program Files\Java\jre7\lib\applet\backup.exe
      "C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
      4⤵
      PID:2308
  - - C:\Program Files\Java\jre7\lib\deploy\backup.exe
      "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
      4⤵
      PID:2564
  - - C:\Program Files\Java\jre7\lib\jfr\System Restore.exe
      "C:\Program Files\Java\jre7\lib\jfr\System Restore.exe" C:\Program Files\Java\jre7\lib\jfr\
      4⤵
      PID:2148
  - - C:\Program Files\Java\jre7\lib\security\backup.exe
      "C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
      4⤵
      PID:1872
  - - C:\Program Files\Java\jre7\lib\zi\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
      4⤵
      PID:3052
    - - C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
        5⤵
        
        PID:2764
    - - C:\Program Files\Java\jre7\lib\zi\America\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
        5⤵
        
        PID:1456
      - C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
        6⤵
        
        PID:1876
      - C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
        6⤵
        
        PID:1412
    - - C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
        5⤵
        
        PID:2816
    - - C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
        5⤵
        
        PID:2392
    - - C:\Program Files\Java\jre7\lib\zi\Australia\update.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Australia\update.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
        5⤵
        
        PID:1676
    - - C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
        5⤵
        
        PID:880
    - - C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
        5⤵
        
        PID:1048
    - - C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
        5⤵
        
        PID:3024

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:1436

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:2220

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
1⤵
PID:2528

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
1⤵
PID:2536

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
1⤵
PID:2592

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
1⤵
PID:2540

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
1⤵
PID:2560
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
  2⤵
  PID:1588
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
  2⤵
  PID:2628

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
1⤵
PID:892

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
1⤵
PID:2348

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:2132

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
1⤵
PID:2408

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
1⤵
PID:1604

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
1⤵
PID:2332

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
1⤵
PID:2984

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
1⤵
PID:1924

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:1792
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
  2⤵
  PID:2712
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
  2⤵
  PID:912

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
1⤵
PID:2096

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:1268
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
  2⤵
  PID:1548
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
  2⤵
  PID:1676
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:1476
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
  2⤵
  PID:1728
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:2320
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
  2⤵
  PID:3024
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:1684
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
  2⤵
  PID:2276
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
  2⤵
  PID:2380
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:1936
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
    3⤵
    PID:2960
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:1068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
    3⤵
    PID:2368
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:2944
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:2772
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:2748
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
    3⤵
    PID:2616
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:2864
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
    3⤵
    PID:1372
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:2444
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1556
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:2732
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
  2⤵
  PID:3064
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:2656
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
  2⤵
  PID:2120
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:1364
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
  2⤵
  PID:1008
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
    3⤵
    PID:2100
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:2344
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
    3⤵
    PID:1908
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:1932
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
    3⤵
    PID:1456
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:2728
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
    3⤵
    PID:1876

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
1⤵
PID:1944
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
  2⤵
  PID:692
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
    3⤵
    PID:2768

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:2460

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:1652
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
  2⤵
  PID:1468
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
    3⤵
    PID:2504
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
  2⤵
  PID:2704
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
    3⤵
    PID:1432
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
    3⤵
    PID:3044
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
    3⤵
    PID:1068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
    3⤵
    PID:2544
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:1528
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
    3⤵
    PID:2672
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:2448
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
    3⤵
    PID:1680
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\data.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
      4⤵
      PID:1124
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
    3⤵
    PID:2476
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
    3⤵
    PID:2488

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
1⤵
PID:1668

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
1⤵
PID:1316

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
1⤵
PID:552

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
1⤵
PID:1856

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
1⤵
PID:1068
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
  2⤵
  PID:2532

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:2700
- C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
  2⤵
  PID:2620
- C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
  2⤵
  PID:2976
- C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
  2⤵
  PID:1432

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:2692
- C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:2880
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:2552
- C:\Program Files\Microsoft Games\FreeCell\it-IT\update.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\update.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:2680

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
1⤵
PID:2568

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:2496

C:\Program Files\Microsoft Games\Mahjong\System Restore.exe
"C:\Program Files\Microsoft Games\Mahjong\System Restore.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:1224
- C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
  2⤵
  PID:2884
- C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
  2⤵
  PID:2172
- C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
  2⤵
  PID:2900
- C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
  2⤵
  PID:2212

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
1⤵
PID:668

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:1568

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
1⤵
PID:1304

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:2252

C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
"C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
1⤵
PID:1728

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
1⤵
PID:1900

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
1⤵
PID:3012

C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
"C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
1⤵
PID:288

C:\Program Files\Microsoft Games\More Games\ja-JP\data.exe
"C:\Program Files\Microsoft Games\More Games\ja-JP\data.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
1⤵
PID:1684

C:\Program Files\Microsoft Games\Multiplayer\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
1⤵
PID:3056
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
  2⤵
  PID:3040
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
    3⤵
    PID:604

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\update.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
1⤵
PID:2924

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:2488

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
1⤵
PID:2756

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
1⤵
PID:1448

C:\Program Files\Microsoft Games\Purble Place\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:1264
- C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
  2⤵
  PID:2340

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:2872
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:2892
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:336

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\System Restore.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
1⤵
PID:3016

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2720

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1880
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:2620
- - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
    3⤵
    PID:1432
- C:\Program Files\Mozilla Firefox\defaults\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
  2⤵
  PID:2080
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:2608
- C:\Program Files\Mozilla Firefox\uninstall\backup.exe
  "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:1564

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:2444
- C:\Program Files\MSBuild\Microsoft\backup.exe
  "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
  2⤵
  PID:1724

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:2308

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:1796
- C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
  2⤵
  PID:2120
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
    3⤵
    PID:1608
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\data.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
      4⤵
      PID:2172
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:2300
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
      4⤵
      PID:1568

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:2888
- C:\Program Files\VideoLAN\VLC\backup.exe
  "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
  2⤵
  PID:756
- - C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
    "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
    3⤵
    PID:2252
- - C:\Program Files\VideoLAN\VLC\locale\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
    3⤵
    PID:560
  - - C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
      4⤵
      PID:1900
    - - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
        5⤵
        
        PID:1748
  - - C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
      4⤵
      PID:604
  - - C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
      4⤵
      PID:2428
  - - C:\Program Files\VideoLAN\VLC\locale\as_IN\System Restore.exe
      "C:\Program Files\VideoLAN\VLC\locale\as_IN\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
      4⤵
      PID:2908
  - - C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
      4⤵
      PID:2924
  - - C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
      4⤵
      PID:1880
    - - C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
        5⤵
        
        PID:752
  - - C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
      4⤵
      PID:2452
  - - C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
      4⤵
      PID:1736
  - - C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
      4⤵
      PID:776
    - - C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
        5⤵
        
        PID:336
  - - C:\Program Files\VideoLAN\VLC\locale\ca\update.exe
      "C:\Program Files\VideoLAN\VLC\locale\ca\update.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
      4⤵
      PID:1684
  - - C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
      4⤵
      PID:2960
    - - C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
        5⤵
        
        PID:2204
  - - C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
      4⤵
      PID:2816
  - - C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
      4⤵
      PID:1304
  - - C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
      4⤵
      PID:2080
  - - C:\Program Files\VideoLAN\VLC\locale\fy\data.exe
      "C:\Program Files\VideoLAN\VLC\locale\fy\data.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
      4⤵
      PID:2356
  - - C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
      4⤵
      PID:2060
  - - C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
      4⤵
      PID:1284
  - - C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
      4⤵
      PID:1432
    - - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
        5⤵
        
        PID:1500
  - - C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
      4⤵
      PID:2636
    - - C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
        5⤵
        
        PID:2760
  - - C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
      4⤵
      PID:1440
    - - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
        5⤵
        
        PID:2532
  - - C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
      4⤵
      PID:1660
    - - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
        5⤵
        
        PID:2260
  - - C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
      4⤵
      PID:3064
    - - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
        5⤵
        
        PID:2788
  - - C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
      4⤵
      PID:2172
  - - C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
      4⤵
      PID:2276
    - - C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
        5⤵
        
        PID:2356
  - - C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
      4⤵
      PID:2636
    - - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
        5⤵
        
        PID:2976
  - - C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
      4⤵
      PID:2164
    - - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
        5⤵
        
        PID:1236
  - - C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
      4⤵
      PID:2424
  - - C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
      4⤵
      PID:2056
    - - C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
        5⤵
        
        PID:2512
- - C:\Program Files\VideoLAN\VLC\skins\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\skins\System Restore.exe" C:\Program Files\VideoLAN\VLC\skins\
    3⤵
    PID:2688
  - - C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
      "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
      4⤵
      PID:2592

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
1⤵
PID:2820

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:2440

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:2472

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
1⤵
PID:1652

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
1⤵
PID:2508

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
1⤵
PID:696

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
1⤵
PID:1284

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:3024

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
1⤵
PID:1700
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
  2⤵
  PID:2280
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
    3⤵
    PID:2836
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
  2⤵
  PID:2104

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:2792
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
  2⤵
  PID:2512

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
1⤵
PID:1436

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
1⤵
PID:1228

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
1⤵
PID:2788

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
1⤵
PID:2100

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
1⤵
PID:2344

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
1⤵
PID:1140
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
  2⤵
  PID:2060

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
1⤵
PID:572

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
1⤵
PID:1732

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:2424
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
  2⤵
  PID:2624
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
  2⤵
  PID:1484

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:2324

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:1016

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:1884

C:\Program Files (x86)\Common Files\backup.exe
"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
1⤵
PID:2408
- C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
  2⤵
  PID:1504
- - C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
    3⤵
    PID:2140
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
    3⤵
    PID:2536
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
      4⤵
      PID:2684
- - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
    3⤵
    PID:928
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
      4⤵
      PID:624
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
    3⤵
    PID:1460
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\System Restore.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
      4⤵
      PID:2700
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
        5⤵
        
        PID:2692
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
        5⤵
        
        PID:2324
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
        5⤵
        
        PID:1236
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
        5⤵
        
        PID:2336
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
        5⤵
        
        PID:1180
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\data.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
        5⤵
        
        PID:928
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
        5⤵
        
        PID:1544
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
        5⤵
        
        PID:3032
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
        5⤵
        
        PID:2156
- - C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
    3⤵
    PID:2672
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
    3⤵
    PID:2080
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
      4⤵
      PID:292
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
    3⤵
    PID:2656
  - - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
      4⤵
      PID:816
- - C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
    3⤵
    PID:1100
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
    3⤵
    PID:1016

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
1⤵
PID:1600

C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe
"C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
1⤵
PID:1876

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
1⤵
PID:880

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:1304

C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
1⤵
PID:1564

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
1⤵
PID:2104

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:2324

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
1⤵
PID:544

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
1⤵
PID:2460

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:1272

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
1⤵
PID:1204

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
1⤵
PID:1532

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:2396

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:2092

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
1⤵
PID:1544

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
1⤵
PID:2060

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
1⤵
PID:1744

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
1⤵
PID:2300

C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
1⤵
PID:2616

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:2552

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
1⤵
PID:2900

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:2128

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
1⤵
PID:2184

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
1⤵
PID:2704

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
1⤵
PID:1596

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
1⤵
PID:2624

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
1⤵
PID:1844

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:988

C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
1⤵
PID:872

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
1⤵
PID:1204

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
1⤵
PID:1372

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:1216

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
1⤵
PID:1804

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
1⤵
PID:1664

C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
1⤵
PID:2712

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
1⤵
PID:776

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
1⤵
PID:668

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
1⤵
PID:1732

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
1⤵
PID:1304

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
1⤵
PID:2468

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
1⤵
PID:2640

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
1⤵
PID:696

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
1⤵
PID:1548

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:552

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
1⤵
PID:908

C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
1⤵
PID:2184

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
1⤵
PID:1708

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\
1⤵
PID:2884

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:1428

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
1⤵
PID:2708

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\
1⤵
PID:912

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
1⤵
PID:1792

C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
1⤵
PID:1676

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
1⤵
PID:2872

C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
1⤵
PID:1936

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\
1⤵
PID:2528

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:488

C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\keystore\
1⤵
PID:1852

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
1⤵
PID:2748

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\
1⤵
PID:292

C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:1148

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\
1⤵
PID:2764

C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\spu\
1⤵
PID:2892

C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_out\
1⤵
PID:544

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\
1⤵
PID:820

C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_output\
1⤵
PID:1408

C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_splitter\
1⤵
PID:2988

C:\Program Files (x86)\Common Files\System\ado\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
1⤵
PID:2632
- C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
  2⤵
  PID:2540
- C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
  2⤵
  PID:2488

C:\Program Files\Windows Defender\it-IT\backup.exe
"C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
1⤵
PID:1428

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:2940
- C:\Program Files\Windows Journal\es-ES\backup.exe
  "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
  2⤵
  PID:880
- C:\Program Files\Windows Journal\it-IT\backup.exe
  "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
  2⤵
  PID:1876

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
1⤵
PID:2712

C:\Program Files\Windows Mail\en-US\backup.exe
"C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
1⤵
PID:1720

C:\Program Files\Windows Mail\ja-JP\backup.exe
"C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
1⤵
PID:2696

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\
1⤵
PID:1880

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:1564

C:\Program Files (x86)\Google\Temp\backup.exe
"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
1⤵
PID:1360

C:\Program Files\Windows Media Player\ja-JP\backup.exe
"C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
1⤵
PID:2004

C:\Program Files\Windows Media Player\Network Sharing\backup.exe
"C:\Program Files\Windows Media Player\Network Sharing\backup.exe" C:\Program Files\Windows Media Player\Network Sharing\
1⤵
PID:1944

C:\Program Files\Windows Media Player\Visualizations\backup.exe
"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\
1⤵
PID:1676

C:\Program Files (x86)\Google\Update\Install\{2C18FE73-0135-4FFC-BCB7-4B0A9050B077}\update.exe
"C:\Program Files (x86)\Google\Update\Install\{2C18FE73-0135-4FFC-BCB7-4B0A9050B077}\update.exe" C:\Program Files (x86)\Google\Update\Install\{2C18FE73-0135-4FFC-BCB7-4B0A9050B077}\
1⤵
PID:1568

C:\Program Files\Windows NT\Accessories\en-US\backup.exe
"C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
1⤵
PID:2796

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
1⤵
PID:2700

C:\Program Files\Windows NT\Accessories\fr-FR\data.exe
"C:\Program Files\Windows NT\Accessories\fr-FR\data.exe" C:\Program Files\Windows NT\Accessories\fr-FR\
1⤵
PID:1424

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
1⤵
PID:2688

C:\Program Files\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files\Windows NT\TableTextService\en-US\
1⤵
PID:2568

C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe
"C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files\Windows NT\TableTextService\fr-FR\
1⤵
PID:1336

C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe
"C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe" C:\Program Files\Windows NT\TableTextService\it-IT\
1⤵
PID:292

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\
1⤵
PID:2860

C:\Program Files\Windows Photo Viewer\en-US\backup.exe
"C:\Program Files\Windows Photo Viewer\en-US\backup.exe" C:\Program Files\Windows Photo Viewer\en-US\
1⤵
PID:2004

C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe
"C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files\Windows Photo Viewer\fr-FR\
1⤵
PID:1796

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
1⤵
PID:2968

C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe
"C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files\Windows Photo Viewer\ja-JP\
1⤵
PID:3016

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\
1⤵
PID:760

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
1⤵
PID:356

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\
1⤵
PID:2152
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
  2⤵
  PID:2632
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
    3⤵
    PID:2876
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\
  2⤵
  PID:2236
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
    3⤵
    PID:2764
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\
  2⤵
  PID:696
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
  2⤵
  PID:2820

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\
1⤵
PID:1184

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
1⤵
PID:572

C:\Program Files (x86)\Microsoft Office\Office14\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\
1⤵
PID:1880
- C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\
  2⤵
  PID:1128
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\
    3⤵
    PID:2672
- C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft Office\Office14\FORMS\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\FORMS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\FORMS\
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\
  2⤵
  PID:1592
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\
    3⤵
    PID:1848
  - - C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\backup.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\
      4⤵
      PID:2808
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\
    3⤵
    PID:848
- C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\
  2⤵
  PID:1324

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\
1⤵
PID:2508
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\System Restore.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\data.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\
  2⤵
  PID:2748

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:2096

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:1564

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\
1⤵
PID:948
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
  2⤵
  PID:1496

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\
1⤵
PID:2920

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
1⤵
PID:2516

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\update.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
1⤵
PID:2120

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\
1⤵
PID:2836
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\
  2⤵
  PID:2744
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\
  2⤵
  PID:2308

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\
1⤵
PID:2556

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\
1⤵
PID:2620

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\
1⤵
PID:2852
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
  2⤵
  PID:2336
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\
    3⤵
    PID:1440

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\
1⤵
PID:2276

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\
1⤵
PID:2252

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\
1⤵
PID:2456

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\
1⤵
PID:1860
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\
  2⤵
  PID:1628

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
1⤵
PID:1924

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\
1⤵
PID:2680
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\
  2⤵
  PID:1732
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\
    3⤵
    PID:1476

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\
1⤵
PID:2040

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
1⤵
PID:552

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\
1⤵
PID:336
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\
  2⤵
  PID:668
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\
  2⤵
  PID:2252

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
1⤵
PID:2464

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\
1⤵
PID:2488

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\
1⤵
PID:1856

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\
1⤵
PID:552

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\
1⤵
PID:876

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\
1⤵
PID:2204

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\
1⤵
PID:2440
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\
  2⤵
  PID:268

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
1⤵
PID:2436

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\
1⤵
PID:1324

C:\Users\Admin\Contacts\backup.exe
C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
1⤵
PID:2400

C:\Users\Admin\Downloads\backup.exe
C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
1⤵
PID:1792

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\
1⤵
PID:2056

C:\Users\Admin\Videos\backup.exe
C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
1⤵
PID:2508

C:\Users\Public\Music\backup.exe
C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
1⤵
PID:2660

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:3016
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
  2⤵
  PID:2256

C:\Users\Public\Recorded TV\backup.exe
"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
1⤵
PID:1900
- C:\Users\Public\Recorded TV\Sample Media\backup.exe
  "C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\
  2⤵
  PID:2604

C:\Program Files (x86)\Microsoft Office\Stationery\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Stationery\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\1033\
1⤵
PID:2072

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:2648
- C:\Windows\AppCompat\backup.exe
  C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
  2⤵
  PID:1908
- C:\Windows\assembly\backup.exe
  C:\Windows\assembly\backup.exe C:\Windows\assembly\
  2⤵
  PID:1652
- - C:\Windows\assembly\GAC\backup.exe
    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
    3⤵
    PID:1596
  - - C:\Windows\assembly\GAC\ADODB\backup.exe
      C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
      4⤵
      PID:320
    - - C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
        5⤵
        
        PID:2456
- C:\Windows\Cursors\backup.exe
  C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
  2⤵
  PID:1184
- C:\Windows\DigitalLocker\backup.exe
  C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
  2⤵
  PID:2720
- - C:\Windows\DigitalLocker\de-DE\backup.exe
    C:\Windows\DigitalLocker\de-DE\backup.exe C:\Windows\DigitalLocker\de-DE\
    3⤵
    PID:1408
- - C:\Windows\DigitalLocker\es-ES\backup.exe
    C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
    3⤵
    PID:352
- C:\Windows\en-US\backup.exe
  C:\Windows\en-US\backup.exe C:\Windows\en-US\
  2⤵
  PID:2516

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\
1⤵
PID:1932

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
1⤵
PID:2432

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\
1⤵
PID:1128
- C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\
  2⤵
  PID:1552

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:2764

C:\Windows\AppPatch\en-US\backup.exe
C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
1⤵
PID:2232

C:\Windows\AppPatch\it-IT\backup.exe
C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\
1⤵
PID:1744

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:2652
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:1724
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\
    3⤵
    PID:2676
  - - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe
      "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\
      4⤵
      PID:2540

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
1⤵
PID:1732

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
1⤵
PID:2416

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\
1⤵
PID:668

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\
1⤵
PID:1272

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
1⤵
PID:2980

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\
1⤵
PID:1264

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe
C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\
1⤵
PID:1504

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\
1⤵
PID:3040

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\
1⤵
PID:2072

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2368

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\data.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\data.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\
1⤵
PID:2680

C:\Program Files\Windows Sidebar\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\ja-JP\
1⤵
PID:2548

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe
C:\Windows\assembly\GAC_32\mcstoredb\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\
1⤵
PID:2632

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:2104

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1844

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:3032

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2792

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:552
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2256

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2696

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:488

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
1⤵
PID:2528
- C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2300

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:3052

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
1⤵
PID:2680

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\
1⤵
PID:3048

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\
1⤵
PID:2620

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
1⤵
PID:2900

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\
1⤵
PID:1428

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\
1⤵
PID:2324

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:1844

C:\Program Files (x86)\Windows Defender\en-US\update.exe
"C:\Program Files (x86)\Windows Defender\en-US\update.exe" C:\Program Files (x86)\Windows Defender\en-US\
1⤵
PID:2156

C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
1⤵
PID:2944

C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\
1⤵
PID:1068

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
1⤵
PID:2396

C:\Program Files (x86)\Windows Mail\it-IT\System Restore.exe
"C:\Program Files (x86)\Windows Mail\it-IT\System Restore.exe" C:\Program Files (x86)\Windows Mail\it-IT\
1⤵
PID:1272

C:\Windows\assembly\GAC_32\naphlpr\data.exe
C:\Windows\assembly\GAC_32\naphlpr\data.exe C:\Windows\assembly\GAC_32\naphlpr\
1⤵
PID:1924

C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe
"C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
1⤵
PID:2056

C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
1⤵
PID:2212

C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe
"C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe" C:\Program Files (x86)\Windows Media Player\it-IT\
1⤵
PID:2480

C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\
1⤵
PID:2140

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2972

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:2448

C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
"C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
1⤵
PID:1148

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:2392

C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe
"C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\
1⤵
PID:2572

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\
1⤵
PID:1216

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
1⤵
PID:2220

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:2592
- C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:1556

C:\Program Files (x86)\Windows NT\Accessories\fr-FR\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\fr-FR\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\fr-FR\
1⤵
PID:2276

C:\Program Files (x86)\Windows NT\Accessories\ja-JP\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\ja-JP\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\ja-JP\
1⤵
PID:2452

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2588

C:\Program Files (x86)\Windows NT\TableTextService\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:2888
- C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\de-DE\
  2⤵
  PID:1508
- C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\es-ES\
  2⤵
  PID:2340
- C:\Program Files (x86)\Windows NT\TableTextService\it-IT\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\it-IT\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\it-IT\
  2⤵
  PID:2876

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:888

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:300

C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:2904
- C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2140

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:2536

C:\Windows\assembly\GAC_64\BDATunePIA\backup.exe
C:\Windows\assembly\GAC_64\BDATunePIA\backup.exe C:\Windows\assembly\GAC_64\BDATunePIA\
1⤵
PID:2332
- C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2728

C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\es-ES\
1⤵
PID:2428

C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
1⤵
PID:2796

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\
1⤵
PID:2976

C:\Windows\assembly\GAC_64\mcstoredb\backup.exe
C:\Windows\assembly\GAC_64\mcstoredb\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\
1⤵
PID:2036

C:\Program Files (x86)\Windows Sidebar\Gadgets\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\
1⤵
PID:1100
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\
  2⤵
  PID:1124
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\
  2⤵
  PID:3020
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\
    3⤵
    PID:980
  - - C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
      "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
      4⤵
      PID:2020
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\
  2⤵
  PID:2712
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
    3⤵
    PID:1928
  - - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe
      "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\
      4⤵
      PID:1872
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\
    3⤵
    PID:560
  - - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
      "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
      4⤵
      PID:1796
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\
    3⤵
    PID:2232

C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2852

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
1⤵
PID:1872

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
1⤵
PID:1596

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1660

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:1496

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\
1⤵
PID:976

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\
1⤵
PID:2520
- C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2584

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\
1⤵
PID:2440

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2092

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2808

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:2340

C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:288

C:\Windows\assembly\GAC_64\napcrypt\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\backup.exe C:\Windows\assembly\GAC_64\napcrypt\
1⤵
PID:2096

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
1⤵
PID:1556
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
  2⤵
  PID:2804

C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2820

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:1732

C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1368
- C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
  2⤵
  PID:2068

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:1900

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1440

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
1⤵
PID:2860

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\
1⤵
PID:1284

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
1⤵
PID:2848

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1804

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
1⤵
PID:2260

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
1⤵
PID:1728
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\
  2⤵
  PID:2332

C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\ehexthost\backup.exe
C:\Windows\assembly\GAC_MSIL\ehexthost\backup.exe C:\Windows\assembly\GAC_MSIL\ehexthost\
1⤵
PID:312

C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\
1⤵
PID:1744

C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\
1⤵
PID:2356

C:\Windows\assembly\GAC_MSIL\ehiiTV\update.exe
C:\Windows\assembly\GAC_MSIL\ehiiTV\update.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\
1⤵
PID:1056
- C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2432

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
1⤵
PID:1452

C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2480

C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1880

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:1848

C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\
1⤵
PID:1708

C:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exe
C:\Windows\assembly\GAC_MSIL\ehRecObj\backup.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\
1⤵
PID:292

C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1584

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:928

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2876

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:1592

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
1⤵
PID:2104

C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:572

C:\Windows\assembly\GAC_MSIL\IIEHost\backup.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\
1⤵
PID:1528

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\
1⤵
PID:1180

C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\
1⤵
PID:1068

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
1⤵
PID:2868

C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2408

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\data.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\data.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\
1⤵
PID:2384

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\
1⤵
PID:908

C:\Windows\assembly\GAC_MSIL\mcplayerinterop\backup.exe
C:\Windows\assembly\GAC_MSIL\mcplayerinterop\backup.exe C:\Windows\assembly\GAC_MSIL\mcplayerinterop\
1⤵
PID:1508

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:1580

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:820

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\
1⤵
PID:2504
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
  2⤵
  PID:1796

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:1048

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
1⤵
PID:540

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\
1⤵
PID:696
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2804
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2152
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2008
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:752

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\
1⤵
PID:2024
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
  2⤵
  PID:2800

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\
1⤵
PID:2456
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\
  2⤵
  PID:2384

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\
1⤵
PID:692
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\System Restore.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\
  2⤵
  PID:892

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:888

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\
1⤵
PID:2656
- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2304

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\
1⤵
PID:2016

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\
1⤵
PID:1676
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
  2⤵
  PID:1876

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:2744

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\
1⤵
PID:1236
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2736

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\
1⤵
PID:2628
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\update.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\
  2⤵
  PID:540

C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\it-IT\
1⤵
PID:348

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2408

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\
1⤵
PID:2540

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\
1⤵
PID:2792
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:2140

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2468

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\
1⤵
PID:1516
- C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:336

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:1264

C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\
1⤵
PID:2256
- C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\data.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2696

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\
1⤵
PID:1852
- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1304
- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\
1⤵
PID:2480
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2852
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1884
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:848
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1448

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\
1⤵
PID:2192
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:908

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\
1⤵
PID:1924
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:2276

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:1608

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\
1⤵
PID:2640
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:604
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2352

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\
1⤵
PID:900

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\
1⤵
PID:1544
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2768

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\
1⤵
PID:1268
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:272

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\
1⤵
PID:1744

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\
1⤵
PID:1132

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\
1⤵
PID:860

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\
1⤵
PID:1584
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:556

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\
1⤵
PID:1916
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1684

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\
1⤵
PID:2444

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\
1⤵
PID:3048

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\
1⤵
PID:2080

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1532

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\
1⤵
PID:892
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:948

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\
1⤵
PID:776
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:300

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\
1⤵
PID:2808

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\
1⤵
PID:1368

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\
1⤵
PID:1468

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\
1⤵
PID:2796
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1528

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\
1⤵
PID:1516
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2472

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\
1⤵
PID:2816
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2984

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\
1⤵
PID:2252
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:292

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\
1⤵
PID:2028

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\
1⤵
PID:548

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\
1⤵
PID:2588

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\
1⤵
PID:1244

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:1732

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\
1⤵
PID:2680

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\
1⤵
PID:352
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:3020

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
1⤵
PID:1428
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1592

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\
1⤵
PID:1484
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:948

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\
1⤵
PID:1800
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2952

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
1⤵
PID:1888

C:\Windows\Branding\Basebrd\en-US\backup.exe
C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
1⤵
PID:2512

C:\Windows\Branding\Basebrd\fr-FR\backup.exe
C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
1⤵
PID:2256

C:\Windows\Branding\Basebrd\it-IT\backup.exe
C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
1⤵
PID:2052

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2368

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2356

C:\Windows\Branding\ShellBrd\update.exe
C:\Windows\Branding\ShellBrd\update.exe C:\Windows\Branding\ShellBrd\
1⤵
PID:1284

C:\Windows\debug\WIA\backup.exe
C:\Windows\debug\WIA\backup.exe C:\Windows\debug\WIA\
1⤵
PID:1548

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:928

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:952

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2952

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2104

C:\Windows\ehome\CreateDisc\backup.exe
C:\Windows\ehome\CreateDisc\backup.exe C:\Windows\ehome\CreateDisc\
1⤵
PID:2808
- C:\Windows\ehome\CreateDisc\style\backup.exe
  C:\Windows\ehome\CreateDisc\style\backup.exe C:\Windows\ehome\CreateDisc\style\
  2⤵
  PID:1048

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2976

C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe
C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\
1⤵
PID:668

C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\
1⤵
PID:2364

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\
1⤵
PID:1212
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2464
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:888

C:\Windows\ehome\en-US\backup.exe
C:\Windows\ehome\en-US\backup.exe C:\Windows\ehome\en-US\
1⤵
PID:2680

C:\Windows\ehome\it-IT\backup.exe
C:\Windows\ehome\it-IT\backup.exe C:\Windows\ehome\it-IT\
1⤵
PID:1440

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2568

C:\Windows\ehome\MCX\backup.exe
C:\Windows\ehome\MCX\backup.exe C:\Windows\ehome\MCX\
1⤵
PID:2016

C:\Windows\ehome\wow\de-DE\backup.exe
C:\Windows\ehome\wow\de-DE\backup.exe C:\Windows\ehome\wow\de-DE\
1⤵
PID:2708

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1604

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2436

C:\Windows\ehome\wow\fr-FR\backup.exe
C:\Windows\ehome\wow\fr-FR\backup.exe C:\Windows\ehome\wow\fr-FR\
1⤵
PID:1512

C:\Windows\ehome\wow\it-IT\backup.exe
C:\Windows\ehome\wow\it-IT\backup.exe C:\Windows\ehome\wow\it-IT\
1⤵
PID:2488

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\
1⤵
PID:2652
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1132

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2800

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2856

C:\Windows\Globalization\ELS\backup.exe
C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
1⤵
PID:2060

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2540

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:2344

C:\Windows\Help\Help\de-DE\backup.exe
C:\Windows\Help\Help\de-DE\backup.exe C:\Windows\Help\Help\de-DE\
1⤵
PID:2240

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2340

C:\Windows\Help\Help\ja-JP\backup.exe
C:\Windows\Help\Help\ja-JP\backup.exe C:\Windows\Help\Help\ja-JP\
1⤵
PID:1788

C:\Windows\Help\mui\0407\backup.exe
C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
1⤵
PID:2256

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1372

C:\Windows\Help\mui\0410\backup.exe
C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\
1⤵
PID:1412

C:\Windows\Help\mui\0C0A\backup.exe
C:\Windows\Help\mui\0C0A\backup.exe C:\Windows\Help\mui\0C0A\
1⤵
PID:876

C:\Windows\Help\Windows\de-DE\backup.exe
C:\Windows\Help\Windows\de-DE\backup.exe C:\Windows\Help\Windows\de-DE\
1⤵
PID:2808

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\
1⤵
PID:472
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1676
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2368

C:\Windows\IME\imekr8\help\backup.exe
C:\Windows\IME\imekr8\help\backup.exe C:\Windows\IME\imekr8\help\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\
1⤵
PID:1100

C:\Windows\IME\ja-JP\backup.exe
C:\Windows\IME\ja-JP\backup.exe C:\Windows\IME\ja-JP\
1⤵
PID:2464

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2740

C:\Windows\inf\ASP.NET\0000\backup.exe
C:\Windows\inf\ASP.NET\0000\backup.exe C:\Windows\inf\ASP.NET\0000\
1⤵
PID:1584

C:\Windows\inf\ASP.NET\0005\backup.exe
C:\Windows\inf\ASP.NET\0005\backup.exe C:\Windows\inf\ASP.NET\0005\
1⤵
PID:2660

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\
1⤵
PID:640

C:\Windows\inf\ASP.NET\0007\backup.exe
C:\Windows\inf\ASP.NET\0007\backup.exe C:\Windows\inf\ASP.NET\0007\
1⤵
PID:2644

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1804

C:\Windows\inf\ASP.NET\000C\backup.exe
C:\Windows\inf\ASP.NET\000C\backup.exe C:\Windows\inf\ASP.NET\000C\
1⤵
PID:2492

C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\
1⤵
PID:872

C:\Windows\inf\ASP.NET\0014\backup.exe
C:\Windows\inf\ASP.NET\0014\backup.exe C:\Windows\inf\ASP.NET\0014\
1⤵
PID:2480

C:\Windows\inf\ASP.NET\0015\backup.exe
C:\Windows\inf\ASP.NET\0015\backup.exe C:\Windows\inf\ASP.NET\0015\
1⤵
PID:1408

C:\Windows\inf\ASP.NET\001D\backup.exe
C:\Windows\inf\ASP.NET\001D\backup.exe C:\Windows\inf\ASP.NET\001D\
1⤵
PID:2148

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\
1⤵
PID:3048

C:\Windows\inf\ASP.NET\0404\backup.exe
C:\Windows\inf\ASP.NET\0404\backup.exe C:\Windows\inf\ASP.NET\0404\
1⤵
PID:1792

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2732

C:\Windows\inf\ASP.NET\0804\backup.exe
C:\Windows\inf\ASP.NET\0804\backup.exe C:\Windows\inf\ASP.NET\0804\
1⤵
PID:2544

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1736

C:\Windows\inf\ASP.NET_4.0.30319\0007\data.exe
C:\Windows\inf\ASP.NET_4.0.30319\0007\data.exe C:\Windows\inf\ASP.NET_4.0.30319\0007\
1⤵
PID:2064

C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0009\
1⤵
PID:2460

C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000D\
1⤵
PID:1072

C:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0011\
1⤵
PID:2408

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2636

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\
1⤵
PID:640

C:\Windows\inf\ASP.NET_4.0.30319\0404\update.exe
C:\Windows\inf\ASP.NET_4.0.30319\0404\update.exe C:\Windows\inf\ASP.NET_4.0.30319\0404\
1⤵
PID:2880

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1368

C:\Windows\inf\ASP.NET_4.0.30319\0804\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0804\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0804\
1⤵
PID:2504

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1528

C:\Windows\inf\aspnet_state\backup.exe
C:\Windows\inf\aspnet_state\backup.exe C:\Windows\inf\aspnet_state\
1⤵
PID:2576
- C:\Windows\inf\aspnet_state\0006\backup.exe
  C:\Windows\inf\aspnet_state\0006\backup.exe C:\Windows\inf\aspnet_state\0006\
  2⤵
  PID:2320
- C:\Windows\inf\aspnet_state\0009\backup.exe
  C:\Windows\inf\aspnet_state\0009\backup.exe C:\Windows\inf\aspnet_state\0009\
  2⤵
  PID:2640
- C:\Windows\inf\aspnet_state\000B\backup.exe
  C:\Windows\inf\aspnet_state\000B\backup.exe C:\Windows\inf\aspnet_state\000B\
  2⤵
  PID:1244
- C:\Windows\inf\aspnet_state\000E\data.exe
  C:\Windows\inf\aspnet_state\000E\data.exe C:\Windows\inf\aspnet_state\000E\
  2⤵
  PID:1688
- C:\Windows\inf\aspnet_state\0011\update.exe
  C:\Windows\inf\aspnet_state\0011\update.exe C:\Windows\inf\aspnet_state\0011\
  2⤵
  PID:1496
- C:\Windows\inf\aspnet_state\0014\backup.exe
  C:\Windows\inf\aspnet_state\0014\backup.exe C:\Windows\inf\aspnet_state\0014\
  2⤵
  PID:2604

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2036

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2624

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2468

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:336

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2772

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:2744

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2896

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1924

C:\Windows\inf\BITS\0C0A\backup.exe
C:\Windows\inf\BITS\0C0A\backup.exe C:\Windows\inf\BITS\0C0A\
1⤵
PID:2768

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\
1⤵
PID:2536

C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\
1⤵
PID:1700

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\
1⤵
PID:2692

C:\Windows\inf\ESENT\040C\backup.exe
C:\Windows\inf\ESENT\040C\backup.exe C:\Windows\inf\ESENT\040C\
1⤵
PID:3044

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2476

C:\Windows\inf\es-ES\backup.exe
C:\Windows\inf\es-ES\backup.exe C:\Windows\inf\es-ES\
1⤵
PID:2148

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\
1⤵
PID:2672

C:\Windows\inf\it-IT\backup.exe
C:\Windows\inf\it-IT\backup.exe C:\Windows\inf\it-IT\
1⤵
PID:1440

C:\Windows\inf\ja-JP\update.exe
C:\Windows\inf\ja-JP\update.exe C:\Windows\inf\ja-JP\
1⤵
PID:2876

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1708

C:\Windows\inf\MSDTC\0000\backup.exe
C:\Windows\inf\MSDTC\0000\backup.exe C:\Windows\inf\MSDTC\0000\
1⤵
PID:336

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1364

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\
1⤵
PID:1704

C:\Windows\inf\MSDTC\040C\backup.exe
C:\Windows\inf\MSDTC\040C\backup.exe C:\Windows\inf\MSDTC\040C\
1⤵
PID:2396

C:\Windows\inf\MSDTC\0411\backup.exe
C:\Windows\inf\MSDTC\0411\backup.exe C:\Windows\inf\MSDTC\0411\
1⤵
PID:2036

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\
1⤵
PID:2172
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1440

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\
1⤵
PID:2352

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\
1⤵
PID:2904

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\
1⤵
PID:2324

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\
1⤵
PID:2900

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\
1⤵
PID:2656

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\
1⤵
PID:2912

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\
1⤵
PID:2428

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\
1⤵
PID:2008

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\
1⤵
PID:1588

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\
1⤵
PID:2552

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\
1⤵
PID:948

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\
1⤵
PID:2104

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\
1⤵
PID:328

C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\
1⤵
PID:1856

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\
1⤵
PID:2988

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1732

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\
1⤵
PID:1316

C:\Windows\inf\PERFLIB\backup.exe
C:\Windows\inf\PERFLIB\backup.exe C:\Windows\inf\PERFLIB\
1⤵
PID:2940
- C:\Windows\inf\PERFLIB\0000\backup.exe
  C:\Windows\inf\PERFLIB\0000\backup.exe C:\Windows\inf\PERFLIB\0000\
  2⤵
  PID:2720

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\
1⤵
PID:2436

C:\Windows\inf\PNRPSvc\0409\update.exe
C:\Windows\inf\PNRPSvc\0409\update.exe C:\Windows\inf\PNRPSvc\0409\
1⤵
PID:1588

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
1⤵
PID:3020

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2968

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1316

C:\Windows\inf\rdyboost\backup.exe
C:\Windows\inf\rdyboost\backup.exe C:\Windows\inf\rdyboost\
1⤵
PID:2888
- C:\Windows\inf\rdyboost\0000\backup.exe
  C:\Windows\inf\rdyboost\0000\backup.exe C:\Windows\inf\rdyboost\0000\
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
506ed4a8b19acb4f8808a486e461f55d

SHA1
dd1cba17e5ab32d1613adfd13bb70d21957c3696

SHA256
fbdc614ea227757a5d080bd71445789ec869d6c050661365db33ef244534ca7c

SHA512
c4bf60ef42021d709635284ceb920c75526f69bd1e6de7cf9f50d3e0d59a4dcba221b0b705a9f7a2788bc8b7c7492a6c007147cd54101fac6a62bced2fabdf2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_2049673321\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
836d1aa72f1a79f99a25d34fac89fcaf

SHA1
3564165f11431ffa557d50eedd13dc0d0190a663

SHA256
f38ba4c38cdc8efc0d381b89b1ae4ae4452e3dffaba380bdaebe471445bad01c

SHA512
b05d7c9d4d805f383f3e9b026583ba13d48c8635845e504327241d93a657b4ebdf6aa5c71845371a50a1eae1812134e0a6a390f17806dc490b41ca825cd8af59

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
67a695a52b9009334590bd300e36f85f

SHA1
ce1f6d813e6e979674707b8c6c62b4934b6dbd07

SHA256
9655e918df594a424de9c008f59a3ef9d26b2c13815b7cef29c20d6c43ed92f8

SHA512
6cc339a1e216a41317d04b70c7b9c28915b09c8741203803a696ed1ca7b8ac274d39d2293a770b3a274948edd74dea6e5be0ad19e9a4cc48d1ba4d542d347fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
94b0f52a0504b6c940dbaa915ddaf900

SHA1
0fdf4d9d4b6896866b529398248acd5b1df5b4c0

SHA256
4df5c4b78e48368ba9e8e8c9bd9ad38e253c32590b760217b4309701e233f722

SHA512
dfe09916900e81a43ee1e61cec47a9ac148234d86e0fcd032ee32ecb600c026b2ad659cb03ceace76f06ca27cc0b1095a82c9a7cc85aa405c455d1497371e508

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
ab6786e8003af7b9ba88a15f2ca006e5

SHA1
850a696ebdd47ea8019c01aefb776131e052f108

SHA256
580ceeb4cd11a761c8296df36cf31ea2f77d37cb296d42f9348fb040b15941d3

SHA512
7c9597d38866f054443d0bad930a0a79d50c271a46c9d6762678c3a50f353f49e965a0fd8ca279387ba2b9e56e0371eb87941b9b033f9edc0fefe788708af1f3

Download Submit
\Users\Admin\AppData\Local\Temp\2097036134\backup.exe

Filesize
72KB

MD5
bcb4077c02e48ae6ba0102af7f7bfc93

SHA1
121e9793b2a3fb7e81873cd386661abc8fd82000

SHA256
e4158735c556e7bff1aea293d34ef9e8ec7328b92f6037cb0ad9056ae8aa68ce

SHA512
c184be46656e942241bd328b37fce3baa0643139c42c4d636e0389b20ebe8fe9acc4fcaf469f7bc4a6f71feefb76a4b66dfc7417c8e3cf607cfc262a7cd0633c

Download Submit
memory/1552-12965-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1660-12124-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2152-10514-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2324-17696-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2464-11727-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2480-7508-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2584-18151-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2700-22302-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2856-18122-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2912-2035-0x0000000077180000-0x000000007727A000-memory.dmp

Filesize
1000KB

Download
memory/2912-2036-0x0000000002A70000-0x0000000002B80000-memory.dmp

Filesize
1.1MB

Download
memory/2912-2034-0x0000000077280000-0x000000007739F000-memory.dmp

Filesize
1.1MB

Download
memory/2912-22665-0x0000000077280000-0x000000007739F000-memory.dmp

Filesize
1.1MB

Download
memory/2944-21661-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads