6669d0eaa71c1438197e2c1e8bfb30025f1212039fa6b37da0189059c009f0ee

Analysis

max time kernel
77s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6669d0eaa71c1438197e2c1e8bfb30025f1212039fa6b37da0189059c009f0ee.exe
Size

72KB
MD5

d459b2ef0246dd20f4c6ab12281cb54e
SHA1

921b201a5928617f4d9a51542a0e94954ca5514f
SHA256

6669d0eaa71c1438197e2c1e8bfb30025f1212039fa6b37da0189059c009f0ee
SHA512

86313fc8d32390318a058306bbf2d636710659fa7e2e8ed3f92b9267a609bcd6d204513d1b393807e53303f544f9c39dd70cb6be21dcde13b77ca86ecf40f8ff
SSDEEP

768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr3k70k:teThavEjDWguKUD

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\6669d0eaa71c1438197e2c1e8bfb30025f1212039fa6b37da0189059c009f0ee.exe
"C:\Users\Admin\AppData\Local\Temp\6669d0eaa71c1438197e2c1e8bfb30025f1212039fa6b37da0189059c009f0ee.exe"
1⤵
PID:2864
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2476

C:\PerfLogs\Admin\backup.exe
C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
1⤵
PID:2900

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:1748

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:932

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:1500

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
1⤵
PID:868

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
1⤵
PID:2788

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
1⤵
PID:2924

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
1⤵
PID:2400

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
1⤵
PID:2660

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
1⤵
PID:2764

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2508

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:2192

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:2880

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2500

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:2784

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
1⤵
PID:2172

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:1308

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:2320

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
1⤵
PID:1900

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:2512

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:1580

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:1392

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:780

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:1380

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
1⤵
PID:904

C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
1⤵
PID:1508

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:1572

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2716
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:1712
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:2568
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:2960
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:2700

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
1⤵
PID:2668

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
1⤵
PID:2872

C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
1⤵
PID:1308

C:\Program Files\Common Files\Microsoft Shared\VC\data.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:1828

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:664

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:2100

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:2824

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:592
- C:\Program Files\Common Files\System\de-DE\backup.exe
  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:2284
- C:\Program Files\Common Files\System\en-US\backup.exe
  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:1688
- C:\Program Files\Common Files\System\es-ES\data.exe
  "C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\
  2⤵
  PID:2084
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:1524

C:\Program Files\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:916

C:\Program Files\Common Files\System\ado\en-US\backup.exe
"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
1⤵
PID:1124

C:\Program Files\Common Files\System\ado\es-ES\update.exe
"C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\
1⤵
PID:844

C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
1⤵
PID:1748

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:2636

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:848

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
1⤵
PID:1796

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
1⤵
PID:2772

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:2528

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:2944

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:1784

C:\Program Files\DVD Maker\fr-FR\update.exe
"C:\Program Files\DVD Maker\fr-FR\update.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:1816

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2120
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:2244
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
    3⤵
    PID:2812
- - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
    3⤵
    PID:2544
- - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
    3⤵
    PID:1908
- - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
    3⤵
    PID:2428
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
    3⤵
    PID:2432
- - C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\data.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
    3⤵
    PID:1200
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
    3⤵
    PID:1524
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\update.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
    3⤵
    PID:2596

C:\Program Files\Google\Chrome\System Restore.exe
"C:\Program Files\Google\Chrome\System Restore.exe" C:\Program Files\Google\Chrome\
1⤵
PID:848
- C:\Program Files\Google\Chrome\Application\backup.exe
  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
  2⤵
  PID:2780
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
    3⤵
    PID:2764
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
      4⤵
      PID:2196
- - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
    3⤵
    PID:2752

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:1156

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:2524

C:\Program Files\Internet Explorer\es-ES\backup.exe
"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:2744

C:\Program Files\Internet Explorer\it-IT\System Restore.exe
"C:\Program Files\Internet Explorer\it-IT\System Restore.exe" C:\Program Files\Internet Explorer\it-IT\
1⤵
PID:1632

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:1428

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
1⤵
PID:692

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
1⤵
PID:2044

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:3008

C:\Program Files\Java\jdk1.7.0_80\jre\bin\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:1500
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
  2⤵
  PID:900
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
  2⤵
  PID:1508

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
1⤵
PID:2548

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:2692

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
1⤵
PID:2488

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
1⤵
PID:2496

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
1⤵
PID:2580

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
1⤵
PID:2340
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
  2⤵
  PID:2640
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
  2⤵
  PID:1684
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
  2⤵
  PID:1520
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
  2⤵
  PID:1352
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
  2⤵
  PID:1648

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
1⤵
PID:2764

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
1⤵
PID:2780

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
1⤵
PID:2320

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:2424
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
  2⤵
  PID:1624
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
    3⤵
    PID:2272
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:2220
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
    3⤵
    PID:992
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
    3⤵
    PID:1872
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:2584
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:2652
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
      4⤵
      PID:1720
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:1888
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:848
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
    3⤵
    PID:2292
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
      4⤵
      PID:2064
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
  2⤵
  PID:992
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
    3⤵
    PID:2164
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
      4⤵
      PID:2692
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
    3⤵
    PID:1720
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
      4⤵
      PID:2488
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
      4⤵
      PID:2620
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
      4⤵
      PID:2468

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
1⤵
PID:3064

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
1⤵
PID:2860

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:1620

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:1556

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:608

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
1⤵
PID:2344

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:2940
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
  2⤵
  PID:772
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
  2⤵
  PID:2548

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:2532

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:2616

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
1⤵
PID:2632

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
1⤵
PID:2876

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
1⤵
PID:852

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:2012

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
1⤵
PID:1116

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:1628

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:1672
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
  2⤵
  PID:2636

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
1⤵
PID:540

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:3052

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2324

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2296

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
1⤵
PID:2652

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
1⤵
PID:2892

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
1⤵
PID:2668

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:1812
- C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
  2⤵
  PID:1484
- C:\Program Files\Java\jre7\bin\server\backup.exe
  "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
  2⤵
  PID:2412

C:\Program Files\Java\jre7\lib\System Restore.exe
"C:\Program Files\Java\jre7\lib\System Restore.exe" C:\Program Files\Java\jre7\lib\
1⤵
PID:2424
- C:\Program Files\Java\jre7\lib\applet\backup.exe
  "C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
  2⤵
  PID:2704
- C:\Program Files\Java\jre7\lib\deploy\update.exe
  "C:\Program Files\Java\jre7\lib\deploy\update.exe" C:\Program Files\Java\jre7\lib\deploy\
  2⤵
  PID:2984
- C:\Program Files\Java\jre7\lib\fonts\backup.exe
  "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
  2⤵
  PID:344
- C:\Program Files\Java\jre7\lib\zi\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
  2⤵
  PID:452
- - C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
    3⤵
    PID:1772
- - C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
    3⤵
    PID:2436
- - C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
    3⤵
    PID:1724
- - C:\Program Files\Java\jre7\lib\zi\Australia\update.exe
    "C:\Program Files\Java\jre7\lib\zi\Australia\update.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
    3⤵
    PID:1228
- - C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
    3⤵
    PID:2816
- - C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
    3⤵
    PID:1856

C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
1⤵
PID:1912

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:2088
- C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
  2⤵
  PID:2792
- C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
  2⤵
  PID:2308
- C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
  2⤵
  PID:2484

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:2756
- C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:2688
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:2764
- C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:2412

C:\Program Files\Microsoft Games\Hearts\backup.exe
"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
1⤵
PID:2336
- C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
  2⤵
  PID:1880
- C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
  2⤵
  PID:2100
- C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
  2⤵
  PID:548

C:\Program Files\Microsoft Games\Mahjong\de-DE\data.exe
"C:\Program Files\Microsoft Games\Mahjong\de-DE\data.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
1⤵
PID:2280

C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
1⤵
PID:844

C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
1⤵
PID:1692

C:\Program Files\Microsoft Games\Minesweeper\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
1⤵
PID:3040
- C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
  2⤵
  PID:2228
- C:\Program Files\Microsoft Games\Minesweeper\it-IT\update.exe
  "C:\Program Files\Microsoft Games\Minesweeper\it-IT\update.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
  2⤵
  PID:1872

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:2736

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2628

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
1⤵
PID:2764

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
1⤵
PID:2460

C:\Program Files\Microsoft Games\Multiplayer\Spades\update.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
1⤵
PID:1764
- C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
  2⤵
  PID:2008
- C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\update.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
  2⤵
  PID:1644

C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
1⤵
PID:3012

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
1⤵
PID:1624

C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
1⤵
PID:1908

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
1⤵
PID:868

C:\Program Files\Microsoft Games\SpiderSolitaire\System Restore.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\System Restore.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:2736
- C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
  2⤵
  PID:1876
- C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
  2⤵
  PID:2164

C:\Program Files\Microsoft Office\update.exe
"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\
1⤵
PID:2476

C:\Program Files\Microsoft Office\Office14\1033\backup.exe
"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
1⤵
PID:2520

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:804
- C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
  2⤵
  PID:2500

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:2644

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:1256

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:808

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System Restore.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System Restore.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2008
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:1428

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:1592
- C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
  2⤵
  PID:2744
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
    3⤵
    PID:1636
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
      4⤵
      PID:2432
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:1148
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
      4⤵
      PID:1988

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
1⤵
PID:1916

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
1⤵
PID:2484

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
1⤵
PID:1816

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
1⤵
PID:1612
- C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
  2⤵
  PID:1428

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:2812

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
1⤵
PID:2232

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
1⤵
PID:1616

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
1⤵
PID:288

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
1⤵
PID:300
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
  2⤵
  PID:2588
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
  2⤵
  PID:2412

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
1⤵
PID:2504

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
1⤵
PID:2500

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
1⤵
PID:2944

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
1⤵
PID:1436

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
1⤵
PID:780

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
1⤵
PID:2044

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
1⤵
PID:892

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
1⤵
PID:2360

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
1⤵
PID:2672

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2720

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
1⤵
PID:1988

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:804

C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
1⤵
PID:1256

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2712

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
1⤵
PID:1080

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
1⤵
PID:2788

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
1⤵
PID:2272
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:1152
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
  2⤵
  PID:3052
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
  2⤵
  PID:2408
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:1332

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
1⤵
PID:2672

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
1⤵
PID:2576

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:2020

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:2860

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:2260

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
1⤵
PID:1772

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:2084

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
1⤵
PID:2952

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
1⤵
PID:892
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:2244
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:2800
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:2676
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:2560

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:560

C:\Program Files\VideoLAN\VLC\locale\fr\update.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\update.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
1⤵
PID:1248

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
1⤵
PID:2516

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
1⤵
PID:2720
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
  2⤵
  PID:1484

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
1⤵
PID:2480

C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
1⤵
PID:304

C:\Program Files\VideoLAN\VLC\locale\gu\data.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\data.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
1⤵
PID:2188

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
1⤵
PID:1776

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
1⤵
PID:3032

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
1⤵
PID:2792

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
1⤵
PID:2464

C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
1⤵
PID:2560

C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
1⤵
PID:2576

C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
1⤵
PID:1424
- C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
  2⤵
  PID:2468

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
1⤵
PID:2288

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
1⤵
PID:2712

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
1⤵
PID:844

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
1⤵
PID:2188
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
  2⤵
  PID:3016
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
  2⤵
  PID:1816
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
  2⤵
  PID:1284
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
  2⤵
  PID:2636
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
  2⤵
  PID:2748

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:1548

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:904

C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
1⤵
PID:1572

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:2956
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
  2⤵
  PID:2296
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
  2⤵
  PID:2476
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
  2⤵
  PID:2572
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
  2⤵
  PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
  2⤵
  PID:1272
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
  2⤵
  PID:1772
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
  2⤵
  PID:2552
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
  2⤵
  PID:3008
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
  2⤵
  PID:2068
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
  2⤵
  PID:2528
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
  2⤵
  PID:2172
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
  2⤵
  PID:1592
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
  2⤵
  PID:1896
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
  2⤵
  PID:2652
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
  2⤵
  PID:2292
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
  2⤵
  PID:2212
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
  2⤵
  PID:2456
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
  2⤵
  PID:608
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
  2⤵
  PID:2672
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
  2⤵
  PID:2736
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
  2⤵
  PID:2180

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:2708

C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
1⤵
PID:2628
- C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
  2⤵
  PID:2848

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:2100

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:1236

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:1856

C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
1⤵
PID:2524

C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
1⤵
PID:1828

C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
1⤵
PID:2116

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:2568

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
1⤵
PID:2616

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
1⤵
PID:2752
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
  2⤵
  PID:652
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
  2⤵
  PID:1896
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
  2⤵
  PID:2468
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
  2⤵
  PID:308
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
  2⤵
  PID:1528

C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
1⤵
PID:2272
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
  2⤵
  PID:2728

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
1⤵
PID:1764
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
  2⤵
  PID:2552
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\
  2⤵
  PID:1508
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\
  2⤵
  PID:1200
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
  2⤵
  PID:2908

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:2828

C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
1⤵
PID:2380
- C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
  2⤵
  PID:3052

C:\Program Files (x86)\Common Files\microsoft shared\VBA\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
1⤵
PID:2824
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
  2⤵
  PID:1032
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
  2⤵
  PID:2608
- - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
    3⤵
    PID:2568

C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
1⤵
PID:1596

C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
1⤵
PID:2672

C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
1⤵
PID:2476

C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
1⤵
PID:2880

C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
1⤵
PID:2912

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\
1⤵
PID:2780

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:2420

C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
1⤵
PID:852

C:\Program Files\VideoLAN\VLC\locale\tet\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\tet\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
1⤵
PID:2688

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
1⤵
PID:1480

C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
1⤵
PID:2404

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\
1⤵
PID:1772

C:\Program Files\VideoLAN\VLC\locale\tl\data.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\data.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
1⤵
PID:1116

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\
1⤵
PID:2536

C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
1⤵
PID:1548

C:\Program Files\VideoLAN\VLC\locale\ug\data.exe
"C:\Program Files\VideoLAN\VLC\locale\ug\data.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
1⤵
PID:1716
- C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
  2⤵
  PID:1760

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\
1⤵
PID:2424
- C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\
  2⤵
  PID:1536

C:\Program Files (x86)\Common Files\System\backup.exe
"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
1⤵
PID:2584
- C:\Program Files (x86)\Common Files\System\ado\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
  2⤵
  PID:312
- C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
  2⤵
  PID:2212
- C:\Program Files (x86)\Common Files\System\msadc\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
  2⤵
  PID:2324
- - C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\
    3⤵
    PID:1228
- - C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
    3⤵
    PID:1032
- - C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\
    3⤵
    PID:2472

C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
1⤵
PID:2932

C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
1⤵
PID:2552

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
1⤵
PID:2888

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe
"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\
1⤵
PID:2528

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\
1⤵
PID:2420

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:1752

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
1⤵
PID:2184

C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
1⤵
PID:2448

C:\Program Files (x86)\Google\CrashReports\backup.exe
"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
1⤵
PID:2100

C:\Program Files (x86)\Google\Temp\backup.exe
"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
1⤵
PID:2480

C:\Program Files (x86)\Google\Update\backup.exe
"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
1⤵
PID:3016
- C:\Program Files (x86)\Google\Update\Download\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
  2⤵
  PID:2284

C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
1⤵
PID:2460

C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
1⤵
PID:2344

C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
1⤵
PID:1512

C:\Program Files (x86)\Google\Update\Install\{1FD4E3A4-6FE0-492C-90E9-7EE360CDB9FF}\update.exe
"C:\Program Files (x86)\Google\Update\Install\{1FD4E3A4-6FE0-492C-90E9-7EE360CDB9FF}\update.exe" C:\Program Files (x86)\Google\Update\Install\{1FD4E3A4-6FE0-492C-90E9-7EE360CDB9FF}\
1⤵
PID:948

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
1⤵
PID:2980

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
1⤵
PID:2720

C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
1⤵
PID:1924

C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
1⤵
PID:2392

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
1⤵
PID:2776

C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
1⤵
PID:2524

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\
1⤵
PID:548

C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:1556

C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\spu\
1⤵
PID:540

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
1⤵
PID:1676

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\
1⤵
PID:2236

C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\text_renderer\
1⤵
PID:2364

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\
1⤵
PID:2680

C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_output\
1⤵
PID:2372

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\
1⤵
PID:1804

C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\visualization\
1⤵
PID:2744

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
1⤵
PID:2500

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\
1⤵
PID:2064

C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
1⤵
PID:332

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\
1⤵
PID:852

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2944
- C:\Program Files\Windows Defender\ja-JP\backup.exe
  "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:548

C:\Program Files (x86)\Microsoft Office\Office14\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\
1⤵
PID:3012
- C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\
  2⤵
  PID:1980

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\
1⤵
PID:2804

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\
1⤵
PID:2868

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\
1⤵
PID:1504

C:\Program Files\Windows Journal\de-DE\backup.exe
"C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
1⤵
PID:1580

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\
1⤵
PID:1536

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\
1⤵
PID:772

C:\Program Files\Windows Mail\de-DE\System Restore.exe
"C:\Program Files\Windows Mail\de-DE\System Restore.exe" C:\Program Files\Windows Mail\de-DE\
1⤵
PID:2372

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\
1⤵
PID:1848

C:\Program Files\Windows Mail\es-ES\backup.exe
"C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
1⤵
PID:2616

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\
1⤵
PID:2484

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
1⤵
PID:2064

C:\Program Files\Windows Mail\it-IT\backup.exe
"C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
1⤵
PID:1660

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:312

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\
1⤵
PID:1272

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:2192

C:\Program Files\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
1⤵
PID:2684

C:\Program Files\Windows Media Player\Skins\backup.exe
"C:\Program Files\Windows Media Player\Skins\backup.exe" C:\Program Files\Windows Media Player\Skins\
1⤵
PID:1764

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\
1⤵
PID:2724

C:\Program Files\Windows NT\Accessories\ja-JP\update.exe
"C:\Program Files\Windows NT\Accessories\ja-JP\update.exe" C:\Program Files\Windows NT\Accessories\ja-JP\
1⤵
PID:2568

C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\
1⤵
PID:2492

C:\Program Files\Windows NT\TableTextService\backup.exe
"C:\Program Files\Windows NT\TableTextService\backup.exe" C:\Program Files\Windows NT\TableTextService\
1⤵
PID:2064
- C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe
  "C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files\Windows NT\TableTextService\de-DE\
  2⤵
  PID:1924
- C:\Program Files\Windows NT\TableTextService\ja-JP\backup.exe
  "C:\Program Files\Windows NT\TableTextService\ja-JP\backup.exe" C:\Program Files\Windows NT\TableTextService\ja-JP\
  2⤵
  PID:1252

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\
1⤵
PID:1828
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\
  2⤵
  PID:2812
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\
    3⤵
    PID:2536

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\
1⤵
PID:880

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\
1⤵
PID:1676
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\
  2⤵
  PID:1976

C:\Program Files\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files\Windows Photo Viewer\it-IT\
1⤵
PID:2352

C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe
"C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files\Windows Photo Viewer\ja-JP\
1⤵
PID:2296

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\
1⤵
PID:2996
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\
  2⤵
  PID:2928

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:1704

C:\Program Files\Windows Sidebar\Gadgets\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\
1⤵
PID:2292
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\
  2⤵
  PID:2124
- - C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\System Restore.exe
    "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\
    3⤵
    PID:2604

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\
1⤵
PID:2640

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
1⤵
PID:1272

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
1⤵
PID:2212

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\
1⤵
PID:2068

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:1876

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\
1⤵
PID:2988

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\
1⤵
PID:2692

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\
1⤵
PID:2344

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\
1⤵
PID:1992

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1484
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:1308
- - C:\Users\Admin\Contacts\System Restore.exe
    "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
    3⤵
    PID:1316
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:2084
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:2260
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:2636

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:2900

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\
1⤵
PID:2848

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
1⤵
PID:2568
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\
  2⤵
  PID:2640

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\
1⤵
PID:2916

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
1⤵
PID:844

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\
1⤵
PID:2708

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\
1⤵
PID:2672
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
  2⤵
  PID:2876

C:\Users\Public\Documents\backup.exe
C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
1⤵
PID:2860

C:\Users\Public\Downloads\backup.exe
C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
1⤵
PID:672

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
1⤵
PID:584

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
1⤵
PID:2472

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\
1⤵
PID:1600

C:\Windows\addins\backup.exe
C:\Windows\addins\backup.exe C:\Windows\addins\
1⤵
PID:2656

C:\Windows\AppCompat\backup.exe
C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
1⤵
PID:2716

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:2780

C:\Windows\AppPatch\Custom\data.exe
C:\Windows\AppPatch\Custom\data.exe C:\Windows\AppPatch\Custom\
1⤵
PID:1988

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\
1⤵
PID:2632

C:\Windows\AppPatch\en-US\backup.exe
C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
1⤵
PID:2412

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:2944

C:\Windows\AppPatch\fr-FR\System Restore.exe
"C:\Windows\AppPatch\fr-FR\System Restore.exe" C:\Windows\AppPatch\fr-FR\
1⤵
PID:2472

C:\Windows\AppPatch\it-IT\backup.exe
C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\
1⤵
PID:1764

C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\
1⤵
PID:2896

C:\Windows\assembly\GAC\backup.exe
C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
1⤵
PID:2656
- C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
  C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
  2⤵
  PID:2588
- - C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
    3⤵
    PID:1744

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\
1⤵
PID:2728

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\
1⤵
PID:1968
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\
  2⤵
  PID:2072

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
1⤵
PID:2520

C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe
"C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\
1⤵
PID:2740
- C:\Program Files (x86)\Microsoft Office\Stationery\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Stationery\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\1033\
  2⤵
  PID:1588

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
1⤵
PID:772

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
1⤵
PID:2792

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\
1⤵
PID:1492

C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\
1⤵
PID:1980
- C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\
  2⤵
  PID:2012

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2524

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
1⤵
PID:2776

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\
1⤵
PID:2448

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1520

C:\Windows\assembly\GAC_32\BDATunePIA\System Restore.exe
"C:\Windows\assembly\GAC_32\BDATunePIA\System Restore.exe" C:\Windows\assembly\GAC_32\BDATunePIA\
1⤵
PID:2984
- C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2748

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\
1⤵
PID:1760

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\
1⤵
PID:868
- C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\System Restore.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\
  2⤵
  PID:3016

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\
1⤵
PID:2456

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
1⤵
PID:2916
- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2068

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
1⤵
PID:2532
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
  2⤵
  PID:2340

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\
1⤵
PID:2872
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
  2⤵
  PID:1588

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
1⤵
PID:2784

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\
1⤵
PID:772

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:2248
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:2300
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\
    3⤵
    PID:1924

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2664

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe
C:\Windows\assembly\GAC_32\mcstoredb\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\
1⤵
PID:2184

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:2224
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1820

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\
1⤵
PID:1636
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2408
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1124

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\
1⤵
PID:1676

C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
1⤵
PID:1696
- C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\
  2⤵
  PID:1888

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\
1⤵
PID:2192

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\
1⤵
PID:2656

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1572

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\
1⤵
PID:2548
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\
  2⤵
  PID:1392

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:1552

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:2364

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\
1⤵
PID:1676
- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1812

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\
1⤵
PID:2512

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
1⤵
PID:2608

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\
1⤵
PID:1512

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2868

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\
1⤵
PID:1572

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
1⤵
PID:2420

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\
1⤵
PID:324

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1996

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
1⤵
PID:692

C:\Windows\assembly\GAC_32\MSBuild\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:2960

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\
1⤵
PID:2764

C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\
1⤵
PID:1596

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:1896

C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2912

C:\Windows\assembly\GAC_32\naphlpr\backup.exe
C:\Windows\assembly\GAC_32\naphlpr\backup.exe C:\Windows\assembly\GAC_32\naphlpr\
1⤵
PID:2556
- C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:312

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:2864

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:2728

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
1⤵
PID:2876

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1752

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
1⤵
PID:2304

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2988

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:1600

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\
1⤵
PID:2028

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\
1⤵
PID:1340
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\
  2⤵
  PID:2692
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\
  2⤵
  PID:1492

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:804

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1924

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
1⤵
PID:2628

C:\Windows\assembly\GAC_32\System.Data\backup.exe
C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:1380
- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:3000

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:1588
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
  2⤵
  PID:2436

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
1⤵
PID:344

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:1472

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:1520

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\
1⤵
PID:2688

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
1⤵
PID:2156

C:\Windows\assembly\GAC_32\System.Printing\update.exe
C:\Windows\assembly\GAC_32\System.Printing\update.exe C:\Windows\assembly\GAC_32\System.Printing\
1⤵
PID:2668
- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2352

C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
1⤵
PID:1708

C:\Windows\assembly\GAC_32\System.Web\backup.exe
C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\
1⤵
PID:2692

C:\Program Files (x86)\Windows Defender\it-IT\backup.exe
"C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\
1⤵
PID:900

C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:2824

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\
1⤵
PID:2240
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
  2⤵
  PID:1712

C:\Program Files (x86)\Windows Mail\de-DE\backup.exe
"C:\Program Files (x86)\Windows Mail\de-DE\backup.exe" C:\Program Files (x86)\Windows Mail\de-DE\
1⤵
PID:2212

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2392

C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe" C:\Program Files (x86)\Windows Mail\fr-FR\
1⤵
PID:2364

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
1⤵
PID:1252

C:\Program Files (x86)\Windows Mail\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Mail\ja-JP\backup.exe" C:\Program Files (x86)\Windows Mail\ja-JP\
1⤵
PID:2008

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1568

C:\Windows\assembly\GAC_64\mcstoredb\backup.exe
C:\Windows\assembly\GAC_64\mcstoredb\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\
1⤵
PID:2320

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\
1⤵
PID:2256

C:\Windows\assembly\GAC_64\Mcx2Dvcs\backup.exe
C:\Windows\assembly\GAC_64\Mcx2Dvcs\backup.exe C:\Windows\assembly\GAC_64\Mcx2Dvcs\
1⤵
PID:1756

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
1⤵
PID:2480

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\
1⤵
PID:540

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:2644

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:2212

C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
"C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
1⤵
PID:1856

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2392

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\
1⤵
PID:1900

C:\Windows\assembly\GAC_64\Microsoft.Ink\System Restore.exe
"C:\Windows\assembly\GAC_64\Microsoft.Ink\System Restore.exe" C:\Windows\assembly\GAC_64\Microsoft.Ink\
1⤵
PID:1848

C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\it-IT\
1⤵
PID:2428

C:\Program Files (x86)\Windows NT\TableTextService\en-US\System Restore.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\System Restore.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
1⤵
PID:2964

C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\
1⤵
PID:2676

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\
1⤵
PID:560

C:\Program Files\Windows Sidebar\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\it-IT\backup.exe" C:\Program Files\Windows Sidebar\it-IT\
1⤵
PID:1596

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:664

C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\es-ES\
1⤵
PID:2504

C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\
1⤵
PID:2640

C:\Program Files (x86)\Windows Sidebar\backup.exe
"C:\Program Files (x86)\Windows Sidebar\backup.exe" C:\Program Files (x86)\Windows Sidebar\
1⤵
PID:2812
- C:\Program Files (x86)\Windows Sidebar\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\de-DE\
  2⤵
  PID:2592
- C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\es-ES\
  2⤵
  PID:1248
- C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\it-IT\
  2⤵
  PID:2496
- C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backup.exe" C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\
  2⤵
  PID:592

C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2868

C:\Windows\assembly\GAC_64\napcrypt\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\backup.exe C:\Windows\assembly\GAC_64\napcrypt\
1⤵
PID:1856
- C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2604

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\
1⤵
PID:2896
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
  2⤵
  PID:2404
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\update.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
    3⤵
    PID:2028
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\
  2⤵
  PID:2452
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
    3⤵
    PID:1420
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
  2⤵
  PID:3040

C:\Windows\assembly\GAC_64\naphlpr\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\backup.exe C:\Windows\assembly\GAC_64\naphlpr\
1⤵
PID:2644
- C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2252

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\data.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\data.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:2688

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\
1⤵
PID:1156

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:1308

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1552

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
1⤵
PID:1660
- C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2980

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1616

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:1816

C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1392

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2160

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
1⤵
PID:3032

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
1⤵
PID:2492

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:300
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\
  2⤵
  PID:1580

C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\
1⤵
PID:1692

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
1⤵
PID:2364

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
1⤵
PID:2984

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\
1⤵
PID:2960

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\
1⤵
PID:1544
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
  2⤵
  PID:2668

C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1332

C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\
1⤵
PID:1896

C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2584

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\
1⤵
PID:844

C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\
1⤵
PID:2752

C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\
1⤵
PID:2576
- C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2212

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\
1⤵
PID:2360

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\
1⤵
PID:2964
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
  2⤵
  PID:1584
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
  2⤵
  PID:628
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
    3⤵
    PID:1472
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\
  2⤵
  PID:2000
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
    3⤵
    PID:300

C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe
C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\
1⤵
PID:540

C:\Windows\assembly\GAC_MSIL\EventViewer\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer\
1⤵
PID:2252

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\
1⤵
PID:356
- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2200
- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1644

C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2752

C:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exe
C:\Windows\assembly\GAC_MSIL\ipdmctrl\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\
1⤵
PID:692

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:1744
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\
  2⤵
  PID:1576
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\data.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
    3⤵
    PID:2516
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\
    3⤵
    PID:1552
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
  2⤵
  PID:2900

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
1⤵
PID:332

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\
1⤵
PID:2924
- C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2928

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:3048

C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2528

C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2172

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2184

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\
1⤵
PID:884

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1648

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1108

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\
1⤵
PID:1716

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2020

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2116

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\
1⤵
PID:1328
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1716

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:2392

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\
1⤵
PID:808
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:2472
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:2432

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\
1⤵
PID:2820

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\
1⤵
PID:1708

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\
1⤵
PID:2672

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\
1⤵
PID:2876

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:312
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\
  2⤵
  PID:2712

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:752

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:628

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:2316

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\
1⤵
PID:1548
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
  2⤵
  PID:2844

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2556

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\
1⤵
PID:1896

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
1⤵
PID:2832

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\
1⤵
PID:844
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\
  2⤵
  PID:2804

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2064

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\
1⤵
PID:2548

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1004

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\
1⤵
PID:2360

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2884

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\
1⤵
PID:1976
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
  2⤵
  PID:2232
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:1552

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:2864
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1296

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\
1⤵
PID:2712
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2832
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2076

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\
1⤵
PID:2860

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\
1⤵
PID:1624

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2408

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\
1⤵
PID:288

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2248

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2284

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\
1⤵
PID:1872
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2124

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\
1⤵
PID:2320

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\
1⤵
PID:2132

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\
1⤵
PID:1676
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:3048

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\
1⤵
PID:2200
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1636

C:\Windows\Branding\backup.exe
C:\Windows\Branding\backup.exe C:\Windows\Branding\
1⤵
PID:1812
- C:\Windows\Branding\Basebrd\backup.exe
  C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
  2⤵
  PID:2428
- - C:\Windows\Branding\Basebrd\en-US\System Restore.exe
    "C:\Windows\Branding\Basebrd\en-US\System Restore.exe" C:\Windows\Branding\Basebrd\en-US\
    3⤵
    PID:1756
- - C:\Windows\Branding\Basebrd\fr-FR\backup.exe
    C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
    3⤵
    PID:1116
- C:\Windows\Branding\ShellBrd\backup.exe
  C:\Windows\Branding\ShellBrd\backup.exe C:\Windows\Branding\ShellBrd\
  2⤵
  PID:628

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2584

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1256

C:\Windows\debug\backup.exe
C:\Windows\debug\backup.exe C:\Windows\debug\
1⤵
PID:1524

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\
1⤵
PID:1536

C:\Windows\DigitalLocker\de-DE\backup.exe
C:\Windows\DigitalLocker\de-DE\backup.exe C:\Windows\DigitalLocker\de-DE\
1⤵
PID:1036

C:\Windows\DigitalLocker\es-ES\backup.exe
C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
1⤵
PID:2404

C:\Windows\DigitalLocker\it-IT\backup.exe
C:\Windows\DigitalLocker\it-IT\backup.exe C:\Windows\DigitalLocker\it-IT\
1⤵
PID:2728

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\
1⤵
PID:652
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2696

C:\Windows\ehome\backup.exe
C:\Windows\ehome\backup.exe C:\Windows\ehome\
1⤵
PID:2004
- C:\Windows\ehome\CreateDisc\backup.exe
  C:\Windows\ehome\CreateDisc\backup.exe C:\Windows\ehome\CreateDisc\
  2⤵
  PID:2480
- C:\Windows\ehome\en-US\backup.exe
  C:\Windows\ehome\en-US\backup.exe C:\Windows\ehome\en-US\
  2⤵
  PID:1156
- C:\Windows\ehome\wow\backup.exe
  C:\Windows\ehome\wow\backup.exe C:\Windows\ehome\wow\
  2⤵
  PID:1756
- - C:\Windows\ehome\wow\fr-FR\backup.exe
    C:\Windows\ehome\wow\fr-FR\backup.exe C:\Windows\ehome\wow\fr-FR\
    3⤵
    PID:2860
- - C:\Windows\ehome\wow\ja-JP\backup.exe
    C:\Windows\ehome\wow\ja-JP\backup.exe C:\Windows\ehome\wow\ja-JP\
    3⤵
    PID:1572

C:\Windows\ehome\CreateDisc\Components\tables\backup.exe
C:\Windows\ehome\CreateDisc\Components\tables\backup.exe C:\Windows\ehome\CreateDisc\Components\tables\
1⤵
PID:1632

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\
1⤵
PID:2340

C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\
1⤵
PID:1696
- C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\System Restore.exe
  "C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\System Restore.exe" C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\
  2⤵
  PID:1148

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2940

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\
1⤵
PID:304

C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\
1⤵
PID:2664
- C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\backup.exe
  C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\
  2⤵
  PID:2124

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\
1⤵
PID:1724
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2676

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\
1⤵
PID:1772

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\
1⤵
PID:2744

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
1⤵
PID:1748

C:\Windows\fr-FR\backup.exe
C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\
1⤵
PID:2244

C:\Windows\Globalization\backup.exe
C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
1⤵
PID:1872
- C:\Windows\Globalization\ELS\backup.exe
  C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
  2⤵
  PID:772

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2676

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:2872

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:2908
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1712

C:\Windows\Help\Help\it-IT\backup.exe
C:\Windows\Help\Help\it-IT\backup.exe C:\Windows\Help\Help\it-IT\
1⤵
PID:1884

C:\Windows\Help\mui\backup.exe
C:\Windows\Help\mui\backup.exe C:\Windows\Help\mui\
1⤵
PID:300
- C:\Windows\Help\mui\0407\backup.exe
  C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
  2⤵
  PID:1048

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2372

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2644

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2728

C:\Windows\Help\Windows\it-IT\backup.exe
C:\Windows\Help\Windows\it-IT\backup.exe C:\Windows\Help\Windows\it-IT\
1⤵
PID:1340

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2692

C:\Windows\IME\de-DE\backup.exe
C:\Windows\IME\de-DE\backup.exe C:\Windows\IME\de-DE\
1⤵
PID:2640

C:\Windows\IME\es-ES\backup.exe
C:\Windows\IME\es-ES\backup.exe C:\Windows\IME\es-ES\
1⤵
PID:948

C:\Windows\IME\IMEJP10\backup.exe
C:\Windows\IME\IMEJP10\backup.exe C:\Windows\IME\IMEJP10\
1⤵
PID:2428
- C:\Windows\IME\IMEJP10\help\backup.exe
  C:\Windows\IME\IMEJP10\help\backup.exe C:\Windows\IME\IMEJP10\help\
  2⤵
  PID:1812

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1616

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2940

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2424

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\
1⤵
PID:1028

C:\Windows\IME\it-IT\backup.exe
C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
1⤵
PID:2728

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2696

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\
1⤵
PID:1296

C:\Windows\inf\ASP.NET\0009\backup.exe
C:\Windows\inf\ASP.NET\0009\backup.exe C:\Windows\inf\ASP.NET\0009\
1⤵
PID:1508

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2372

C:\Windows\inf\ASP.NET\000B\backup.exe
C:\Windows\inf\ASP.NET\000B\backup.exe C:\Windows\inf\ASP.NET\000B\
1⤵
PID:1756

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2548

C:\Windows\inf\ASP.NET\000C\backup.exe
C:\Windows\inf\ASP.NET\000C\backup.exe C:\Windows\inf\ASP.NET\000C\
1⤵
PID:2252

C:\Windows\inf\ASP.NET\000E\backup.exe
C:\Windows\inf\ASP.NET\000E\backup.exe C:\Windows\inf\ASP.NET\000E\
1⤵
PID:2828

C:\Windows\inf\ASP.NET\0011\backup.exe
C:\Windows\inf\ASP.NET\0011\backup.exe C:\Windows\inf\ASP.NET\0011\
1⤵
PID:2284

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2884

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1592

C:\Windows\inf\ASP.NET\0404\backup.exe
C:\Windows\inf\ASP.NET\0404\backup.exe C:\Windows\inf\ASP.NET\0404\
1⤵
PID:2320

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\
1⤵
PID:2868
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:548

C:\Windows\inf\ASP.NET\0416\backup.exe
C:\Windows\inf\ASP.NET\0416\backup.exe C:\Windows\inf\ASP.NET\0416\
1⤵
PID:324

C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0005\
1⤵
PID:2660

C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0006\
1⤵
PID:1572

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1880

C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0008\
1⤵
PID:3012

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:628

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2616

C:\Windows\inf\ASP.NET_4.0.30319\000B\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000B\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000B\
1⤵
PID:2284

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2928

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:540

C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\
1⤵
PID:2888

C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0012\
1⤵
PID:2696

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:2652

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1108

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:472

C:\Windows\inf\aspnet_state\0007\backup.exe
C:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\
1⤵
PID:2092

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2904

C:\Windows\inf\aspnet_state\0010\backup.exe
C:\Windows\inf\aspnet_state\0010\backup.exe C:\Windows\inf\aspnet_state\0010\
1⤵
PID:2420

C:\Windows\inf\aspnet_state\0011\backup.exe
C:\Windows\inf\aspnet_state\0011\backup.exe C:\Windows\inf\aspnet_state\0011\
1⤵
PID:2076

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:584

C:\Windows\inf\aspnet_state\0013\backup.exe
C:\Windows\inf\aspnet_state\0013\backup.exe C:\Windows\inf\aspnet_state\0013\
1⤵
PID:1520

C:\Windows\inf\aspnet_state\0015\backup.exe
C:\Windows\inf\aspnet_state\0015\backup.exe C:\Windows\inf\aspnet_state\0015\
1⤵
PID:2540

C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:3008

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\
1⤵
PID:2228

C:\Windows\inf\aspnet_state\0416\backup.exe
C:\Windows\inf\aspnet_state\0416\backup.exe C:\Windows\inf\aspnet_state\0416\
1⤵
PID:2772

C:\Windows\inf\aspnet_state\0804\backup.exe
C:\Windows\inf\aspnet_state\0804\backup.exe C:\Windows\inf\aspnet_state\0804\
1⤵
PID:1688

C:\Windows\inf\BITS\0410\backup.exe
C:\Windows\inf\BITS\0410\backup.exe C:\Windows\inf\BITS\0410\
1⤵
PID:2632

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:932

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2076

C:\Windows\inf\ESENT\0000\backup.exe
C:\Windows\inf\ESENT\0000\backup.exe C:\Windows\inf\ESENT\0000\
1⤵
PID:1436

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2684

C:\Windows\inf\ESENT\040C\backup.exe
C:\Windows\inf\ESENT\040C\backup.exe C:\Windows\inf\ESENT\040C\
1⤵
PID:2940

C:\Windows\inf\ESENT\0411\backup.exe
C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
1⤵
PID:2996

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2820

C:\Windows\inf\fr-FR\backup.exe
C:\Windows\inf\fr-FR\backup.exe C:\Windows\inf\fr-FR\
1⤵
PID:1836

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2468

C:\Windows\inf\it-IT\backup.exe
C:\Windows\inf\it-IT\backup.exe C:\Windows\inf\it-IT\
1⤵
PID:1536

C:\Windows\inf\MSDTC\0000\backup.exe
C:\Windows\inf\MSDTC\0000\backup.exe C:\Windows\inf\MSDTC\0000\
1⤵
PID:2984

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\
1⤵
PID:2464

C:\Windows\inf\MSDTC\0407\backup.exe
C:\Windows\inf\MSDTC\0407\backup.exe C:\Windows\inf\MSDTC\0407\
1⤵
PID:1876

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\
1⤵
PID:2544
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2804

C:\Windows\inf\MSDTC\040C\update.exe
C:\Windows\inf\MSDTC\040C\update.exe C:\Windows\inf\MSDTC\040C\
1⤵
PID:2136

C:\Windows\inf\MSDTC\0411\backup.exe
C:\Windows\inf\MSDTC\0411\backup.exe C:\Windows\inf\MSDTC\0411\
1⤵
PID:1628

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2904

C:\Windows\inf\MSDTC\0C0A\backup.exe
C:\Windows\inf\MSDTC\0C0A\backup.exe C:\Windows\inf\MSDTC\0C0A\
1⤵
PID:2732

C:\Windows\inf\MSDTC Bridge 3.0.0.0\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\
1⤵
PID:2116
- C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe
  "C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\
  2⤵
  PID:2440
- C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe
  "C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\
  2⤵
  PID:3012

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2604

C:\Windows\inf\MSDTC Bridge 4.0.0.0\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\
1⤵
PID:2860
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\
  2⤵
  PID:2668
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\
  2⤵
  PID:1080
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\
  2⤵
  PID:672
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\
  2⤵
  PID:2980
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\
  2⤵
  PID:1296
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\
  2⤵
  PID:904
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\
  2⤵
  PID:2700
- C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe
  "C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\
  2⤵
  PID:2412

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1536

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2832

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2592

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2320

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\
1⤵
PID:1272
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\
  2⤵
  PID:1772
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\
  2⤵
  PID:1544
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\
  2⤵
  PID:1908
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\
    3⤵
    PID:1392
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\
  2⤵
  PID:2184
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\update.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessD#\
  2⤵
  PID:2232
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\System Restore.exe
  "C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\
  2⤵
  PID:1684
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\
    3⤵
    PID:1796
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\
  2⤵
  PID:2908
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\
    3⤵
    PID:332
- C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\
  2⤵
  PID:2824
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\
    3⤵
    PID:2116
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\
  2⤵
  PID:1192
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3e357e76593a8cc5346dc0431f4cdaa9\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3e357e76593a8cc5346dc0431f4cdaa9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3e357e76593a8cc5346dc0431f4cdaa9\
    3⤵
    PID:1228
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\
  2⤵
  PID:2236
- C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\
  2⤵
  PID:1572
- C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\
  2⤵
  PID:2932
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\
  2⤵
  PID:1588
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\
  2⤵
  PID:628

C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\a0a453714c9ec8d6954490f711f5158a\
1⤵
PID:1572

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:852

C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\
1⤵
PID:1284

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2460

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2232

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\
1⤵
PID:2028

C:\Windows\inf\PERFLIB\0407\backup.exe
C:\Windows\inf\PERFLIB\0407\backup.exe C:\Windows\inf\PERFLIB\0407\
1⤵
PID:1192

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\
1⤵
PID:1148

C:\Windows\inf\PERFLIB\040C\data.exe
C:\Windows\inf\PERFLIB\040C\data.exe C:\Windows\inf\PERFLIB\040C\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2424

C:\Windows\inf\PERFLIB\0411\backup.exe
C:\Windows\inf\PERFLIB\0411\backup.exe C:\Windows\inf\PERFLIB\0411\
1⤵
PID:288

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2092

C:\Windows\inf\PERFLIB\0C0A\backup.exe
C:\Windows\inf\PERFLIB\0C0A\backup.exe C:\Windows\inf\PERFLIB\0C0A\
1⤵
PID:2404

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\
1⤵
PID:1892
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2576

C:\Windows\inf\PNRPSvc\0407\backup.exe
C:\Windows\inf\PNRPSvc\0407\backup.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:2568

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\
1⤵
PID:780

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2440

C:\Windows\inf\rdyboost\0409\data.exe
C:\Windows\inf\rdyboost\0409\data.exe C:\Windows\inf\rdyboost\0409\
1⤵
PID:2424

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\
1⤵
PID:2932
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2516

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\
1⤵
PID:2556
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1248

C:\Windows\inf\RemoteAccess\0407\backup.exe
C:\Windows\inf\RemoteAccess\0407\backup.exe C:\Windows\inf\RemoteAccess\0407\
1⤵
PID:356

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\
1⤵
PID:2120

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\
1⤵
PID:780
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2748

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\
1⤵
PID:2084

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\
1⤵
PID:2428

C:\Windows\inf\RemoteAccess\0411\backup.exe
C:\Windows\inf\RemoteAccess\0411\backup.exe C:\Windows\inf\RemoteAccess\0411\
1⤵
PID:1612

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2480

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\
1⤵
PID:2912

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\
1⤵
PID:2496

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\
1⤵
PID:2848

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\040C\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\040C\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\040C\
1⤵
PID:1500

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\30f8865f88bb953486fd20650b54177c\
1⤵
PID:2412

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\
1⤵
PID:1908

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\
1⤵
PID:1392

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\
1⤵
PID:1720

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\
1⤵
PID:1848
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2640

C:\Windows\inf\ServiceModelService 3.0.0.0\0409\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0409\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0409\
1⤵
PID:2460

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\c737785c9f3035d886a06294e58e3004\
1⤵
PID:2336

C:\Windows\inf\ServiceModelService 3.0.0.0\0411\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0411\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0411\
1⤵
PID:1708

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\
1⤵
PID:2896

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\
1⤵
PID:3064
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1572

C:\Windows\inf\SMSvcHost 3.0.0.0\0000\update.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0000\update.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0000\
1⤵
PID:2648

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
1⤵
PID:1812

C:\Windows\inf\SMSvcHost 3.0.0.0\0407\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0407\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0407\
1⤵
PID:2628

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1856

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\
1⤵
PID:2472

C:\Windows\inf\SMSvcHost 3.0.0.0\040C\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\040C\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\040C\
1⤵
PID:3032

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\
1⤵
PID:2500

C:\Windows\inf\SMSvcHost 3.0.0.0\0411\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0411\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0411\
1⤵
PID:2716

C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\
1⤵
PID:1500
- C:\Windows\inf\SMSvcHost 4.0.0.0\0009\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0009\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0009\
  2⤵
  PID:1816
- C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000B\
  2⤵
  PID:1156
- C:\Windows\inf\SMSvcHost 4.0.0.0\000E\data.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\000E\data.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000E\
  2⤵
  PID:2528
- C:\Windows\inf\SMSvcHost 4.0.0.0\0012\System Restore.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0012\System Restore.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0012\
  2⤵
  PID:2980
- C:\Windows\inf\SMSvcHost 4.0.0.0\0013\update.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0013\update.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0013\
  2⤵
  PID:1236
- C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0015\
  2⤵
  PID:2336
- C:\Windows\inf\SMSvcHost 4.0.0.0\0019\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0019\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0019\
  2⤵
  PID:452
- C:\Windows\inf\SMSvcHost 4.0.0.0\001D\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\001D\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\001D\
  2⤵
  PID:2644
- C:\Windows\inf\SMSvcHost 4.0.0.0\001F\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\001F\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\001F\
  2⤵
  PID:2736

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\
1⤵
PID:2572

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\
1⤵
PID:2320

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2248

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\
1⤵
PID:2708
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:1392
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1784

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\
1⤵
PID:2892

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4bfa36696bef033cf7e33b1a092c8a0f\
1⤵
PID:540

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\
1⤵
PID:1760
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2356

C:\Windows\inf\TermService\backup.exe
C:\Windows\inf\TermService\backup.exe C:\Windows\inf\TermService\
1⤵
PID:1820
- C:\Windows\inf\TermService\0409\backup.exe
  C:\Windows\inf\TermService\0409\backup.exe C:\Windows\inf\TermService\0409\
  2⤵
  PID:1660

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\
1⤵
PID:1116

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\
1⤵
PID:2124

C:\Windows\inf\UGatherer\0410\backup.exe
C:\Windows\inf\UGatherer\0410\backup.exe C:\Windows\inf\UGatherer\0410\
1⤵
PID:1584

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2136

C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\
1⤵
PID:2340

C:\Windows\inf\UGTHRSVC\backup.exe
C:\Windows\inf\UGTHRSVC\backup.exe C:\Windows\inf\UGTHRSVC\
1⤵
PID:1708
- C:\Windows\inf\UGTHRSVC\0407\data.exe
  C:\Windows\inf\UGTHRSVC\0407\data.exe C:\Windows\inf\UGTHRSVC\0407\
  2⤵
  PID:1632
- C:\Windows\inf\UGTHRSVC\0410\backup.exe
  C:\Windows\inf\UGTHRSVC\0410\backup.exe C:\Windows\inf\UGTHRSVC\0410\
  2⤵
  PID:1912

C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\
1⤵
PID:2776

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1880

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2616

C:\Windows\inf\usbhub\0411\backup.exe
C:\Windows\inf\usbhub\0411\backup.exe C:\Windows\inf\usbhub\0411\
1⤵
PID:2224

C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\
1⤵
PID:2660
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0000\
  2⤵
  PID:892
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0409\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0409\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0409\
  2⤵
  PID:1784
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\
  2⤵
  PID:592
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\
  2⤵
  PID:1696

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2264

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2924

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1524

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\
1⤵
PID:1744

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2000

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1880

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0012\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0012\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0012\
1⤵
PID:2256

C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\
1⤵
PID:2056

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001F\
1⤵
PID:1856

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\29c55874e34f9d5cd3ea739262f48adc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\29c55874e34f9d5cd3ea739262f48adc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\29c55874e34f9d5cd3ea739262f48adc\
1⤵
PID:2628

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\
1⤵
PID:1528

C:\Windows\inf\WmiApRpl\0009\backup.exe
C:\Windows\inf\WmiApRpl\0009\backup.exe C:\Windows\inf\WmiApRpl\0009\
1⤵
PID:2404

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\
1⤵
PID:288

C:\Windows\inf\wsearchidxpi\0409\backup.exe
C:\Windows\inf\wsearchidxpi\0409\backup.exe C:\Windows\inf\wsearchidxpi\0409\
1⤵
PID:2820

C:\Windows\inf\wsearchidxpi\040C\backup.exe
C:\Windows\inf\wsearchidxpi\040C\backup.exe C:\Windows\inf\wsearchidxpi\040C\
1⤵
PID:2932

C:\Windows\Logs\backup.exe
C:\Windows\Logs\backup.exe C:\Windows\Logs\
1⤵
PID:2080

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\
1⤵
PID:2372

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:916

C:\Windows\Media\backup.exe
C:\Windows\Media\backup.exe C:\Windows\Media\
1⤵
PID:2404
- C:\Windows\Media\Afternoon\backup.exe
  C:\Windows\Media\Afternoon\backup.exe C:\Windows\Media\Afternoon\
  2⤵
  PID:2824
- C:\Windows\Media\Characters\backup.exe
  C:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\
  2⤵
  PID:2316
- C:\Windows\Media\Garden\backup.exe
  C:\Windows\Media\Garden\backup.exe C:\Windows\Media\Garden\
  2⤵
  PID:1420
- C:\Windows\Media\Heritage\backup.exe
  C:\Windows\Media\Heritage\backup.exe C:\Windows\Media\Heritage\
  2⤵
  PID:2248
- C:\Windows\Media\Landscape\backup.exe
  C:\Windows\Media\Landscape\backup.exe C:\Windows\Media\Landscape\
  2⤵
  PID:2636
- C:\Windows\Media\Sonata\backup.exe
  C:\Windows\Media\Sonata\backup.exe C:\Windows\Media\Sonata\
  2⤵
  PID:2988

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2116

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\
1⤵
PID:1624

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\
1⤵
PID:2708

C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
1ca89186ea914c11dbffbb0a40f1570e

SHA1
54a2175bc5179e5c6b135561d1788ae12146220a

SHA256
1e6e42792f3d70406dcb879ae23691464755bec156926c6101dc5b28d59cccd4

SHA512
313df2e54523cf168ad9e49181b8bf89f41a52f0e3b38fefd85225a4d84257a81e4f34fc43c5bc07592c902131ca9e52cd73268daf7aa710714053e92de753d9

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
4f97ee0ffc15706fc8b19cf5ac0b0d1f

SHA1
2537fe294da1d5baa02e83c8f46421d0a6f6b543

SHA256
ebe213c88121c633ab99add8d8b99622b313cce7bc8f56488f2f8953f13a49ea

SHA512
c3f7ce3688b6bc59f6f1f52164de00cc74f0baf6ce507f962926fda318af5607f1685c7ddd11556fe9fc4da354dec465d25a36aab8b8905dab5d134084e58135

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
116d360d7327fc994bcbd75788821dd5

SHA1
1c973060582f584357af117fa431f0bb205c0240

SHA256
f83e1e524c5219de5a8930a25bf3b1d5b6677931c0d50afe1a5f90eb45c5568b

SHA512
bf8d3a546c4031e5c9d954150fd7fbfae8284a14c3e4f100f0dfffb70eed601d3a7a10048029a1161f4a3ce20169226ea5714da9bb390e96f9cf24bafbcb7b8d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
2fd90e25752d4c7315adaee51e2ddcab

SHA1
cba9d11baa98e9795b7dba4aebc60f7a5718b031

SHA256
fedbd3f90b8fdf8641d06e8599ca85551783b7315dc6b2b3db4f21b15b05d167

SHA512
9698f4a99df01010c9ae101949db6061ad5a672bcbf4d1b81f2a86035cb2823c560705acd5da2ee639f98bf37113ef4058027c6ad20d1c2734a1072269a4d4cf

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
72KB

MD5
ecc3aa60ea8f31461811143e84e79093

SHA1
593ba2e08fbba370e1fe3c979c0a922c054b5593

SHA256
c4dcaee9ead5e152ef303f30674cb3d8b16a6cd23046ceeaceb0d393c9ee336a

SHA512
c2f8518ae0143f3f3049adc001ebf310c93333acb194e0e9de9b7aefbc0211fce2dee59110ba90c595c3616251989a1f617cee55b215f41d662a1b2383f8582c

Download Submit
C:\System Restore.exe

Filesize
72KB

MD5
720a388157be6b1c2369d591d603b2ae

SHA1
142e33d736e93332bcbeac747b557bbc5f4e7e6f

SHA256
f440e753aff7522a150dbb11a51382973c17319034b41e2b9e7d922c878a0daf

SHA512
0a7efb3d9d7c5c3d0c28c0033f9fdcc0d2912d37cbd76162aa7b89feb2bac5043951e8a09128b6df2b6b7b7fa16eb1f7b319c3dc5b77b691bac8ba2428747a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\4185125605\backup.exe

Filesize
72KB

MD5
4e113c0d546995548a4adf5044484752

SHA1
507e2da0b8e06001468ccd8f904557a30a3875fd

SHA256
cafa97cd38d2df5a04ffe0dea86b542fa02a55cecfd33eeea82632dc9e47466b

SHA512
fa40002c9f3979c8c40dcfccb8db4bf5492096525bc85544244333fa44d51f267bb8f54ef032f7074de56976ec836624f315b8112b7607ff6fd70edcfe79b7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
ad385eeece7ffddc48b3280a5de87e8c

SHA1
d1d5afee198e441281a1333a681af433e5e00779

SHA256
4f8c8514b978be9cedcf36deeb5ec509ff752c6d10a9e87fa883f11c30a0d572

SHA512
e4a943a45a6b450a8236393c9e23957f8341a2ee3af1521173dd499c3e02b00b863637d5a9b03d476b587140b6684e9d995d36d78934092444667f081a11e840

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
memory/472-19058-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/916-19085-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/916-19086-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/1036-6569-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1492-16824-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1552-10034-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/1880-18190-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2316-18309-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2336-16933-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2456-18607-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2492-19406-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2516-13163-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2536-7838-0x0000000002AF0000-0x0000000002C00000-memory.dmp

Filesize
1.1MB

Download
memory/2536-11008-0x0000000077720000-0x000000007781A000-memory.dmp

Filesize
1000KB

Download
memory/2536-1396-0x0000000077720000-0x000000007781A000-memory.dmp

Filesize
1000KB

Download
memory/2536-7837-0x0000000077720000-0x000000007781A000-memory.dmp

Filesize
1000KB

Download
memory/2604-15874-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2704-4350-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2752-11530-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2848-19866-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2944-19017-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2944-19015-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/3004-8590-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads