70adef1511265e880a1a454d8975e49d608ad12043a7c1286c5b8eb5e773aaa3

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70adef1511265e880a1a454d8975e49d608ad12043a7c1286c5b8eb5e773aaa3.exe
Size 72KB
Sample240607-bbag4seg6v
SHA256 70adef1511265e880a1a454d8975e49d608ad12043a7c1286c5b8eb5e773aaa3
MD5 d2e58b50c3e7dfeb83bd341f0ae10574
SHA1 46fcb167e3df68f9599d0abb53303b8e7c22c040
SHA512 ebba5974cfac38f62778395ad29aa51d8411f7a65da76868fd9d08f4b745be1a14979cb776991f087bdf327f888f8925f9ed6c7ebc8dbbce481a49e606953d26
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2R:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\70adef1511265e880a1a454d8975e49d608ad12043a7c1286c5b8eb5e773aaa3.exe
"C:\Users\Admin\AppData\Local\Temp\70adef1511265e880a1a454d8975e49d608ad12043a7c1286c5b8eb5e773aaa3.exe"
1⤵
PID:4740
- C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\
  2⤵
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
    C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\
    3⤵
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
      C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\
      4⤵
      PID:3136

C:\backup.exe
\backup.exe \
1⤵
PID:1620
- C:\Users\backup.exe
  C:\Users\backup.exe C:\Users\
  2⤵
  PID:2872
- - C:\Users\Public\backup.exe
    C:\Users\Public\backup.exe C:\Users\Public\
    3⤵
    PID:4452

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
1⤵
PID:2068

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
1⤵
PID:1704
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:1376
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
  2⤵
  PID:1060
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
  2⤵
  PID:2592
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\data.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
  2⤵
  PID:2944
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
  2⤵
  PID:4400
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:1280
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
  2⤵
  PID:2796

C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
1⤵
PID:3188

C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
1⤵
PID:4548

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
1⤵
PID:3708

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
1⤵
PID:3112

C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
1⤵
PID:5012

C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
1⤵
PID:3784

C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
1⤵
PID:2116

C:\Program Files\Common Files\microsoft shared\ink\sv-SE\update.exe
"C:\Program Files\Common Files\microsoft shared\ink\sv-SE\update.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
1⤵
PID:1088

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\update.exe
"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\update.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
1⤵
PID:4456

C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
1⤵
PID:2712

C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
1⤵
PID:3904
- C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
  2⤵
  PID:232
- C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
  2⤵
  PID:1524
- C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:3852
- C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:1376
- C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:4992
- C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\
  2⤵
  PID:5048

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
1⤵
PID:4400

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:4080

C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
1⤵
PID:4420

C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
1⤵
PID:1912

C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
1⤵
PID:644
- C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
  2⤵
  PID:4464

C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
1⤵
PID:4580

C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
1⤵
PID:3672

C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
1⤵
PID:1396
- C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
  2⤵
  PID:3304

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:2408

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:2812
- C:\Program Files\Common Files\System\ado\de-DE\backup.exe
  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
  2⤵
  PID:932
- C:\Program Files\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
  2⤵
  PID:2768
- C:\Program Files\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:3256

C:\Program Files\Common Files\System\en-US\backup.exe
"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
1⤵
PID:632

C:\Program Files\Common Files\System\msadc\en-US\backup.exe
"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
1⤵
PID:1232

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:2332

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
1⤵
PID:4904

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
1⤵
PID:1060

C:\Program Files\Common Files\System\Ole DB\backup.exe
"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
1⤵
PID:4376
- C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
  2⤵
  PID:4028
- C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
  2⤵
  PID:696
- C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:2852

C:\Program Files\dotnet\backup.exe
"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\
1⤵
PID:3092
- C:\Program Files\dotnet\host\backup.exe
  "C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\
  2⤵
  PID:4700

C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe
"C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.27\
1⤵
PID:1616

C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe
"C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe" C:\Program Files\dotnet\host\fxr\7.0.16\
1⤵
PID:4612

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\System Restore.exe
"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\
1⤵
PID:572
- C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe
  "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\
  2⤵
  PID:3304
- C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe
  "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\
  2⤵
  PID:4556
- C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\data.exe
  "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\data.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\
  2⤵
  PID:1168

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\
1⤵
PID:3112
- C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe
  "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\
  2⤵
  PID:1664
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\
    3⤵
    PID:2848
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\
    3⤵
    PID:4120
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\
    3⤵
    PID:3256
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\
    3⤵
    PID:636
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\
    3⤵
    PID:3392
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\
    3⤵
    PID:3608
- C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe
  "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\
  2⤵
  PID:3712
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\
    3⤵
    PID:1604
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\
    3⤵
    PID:992
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\
    3⤵
    PID:4968
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\
    3⤵
    PID:3120
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\
    3⤵
    PID:940

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\
1⤵
PID:4824

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\
1⤵
PID:3680

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\
1⤵
PID:1828

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\
1⤵
PID:4604

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\
1⤵
PID:4136

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\
1⤵
PID:4976

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:1248
- C:\Program Files\Google\Chrome\Application\backup.exe
  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
  2⤵
  PID:2416

C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\
1⤵
PID:632

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\
1⤵
PID:4572

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\
1⤵
PID:1448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:4696

C:\Program Files\Internet Explorer\en-US\backup.exe
"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
1⤵
PID:224

C:\Program Files\Internet Explorer\es-ES\backup.exe
"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:4804

C:\Program Files\Internet Explorer\images\backup.exe
"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
1⤵
PID:4600

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:5000

C:\Program Files\Internet Explorer\uk-UA\backup.exe
"C:\Program Files\Internet Explorer\uk-UA\backup.exe" C:\Program Files\Internet Explorer\uk-UA\
1⤵
PID:696

C:\Program Files\Java\jdk-1.8\backup.exe
"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\
1⤵
PID:1572
- C:\Program Files\Java\jdk-1.8\bin\backup.exe
  "C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
  2⤵
  PID:828
- C:\Program Files\Java\jdk-1.8\include\backup.exe
  "C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\
  2⤵
  PID:2580
- C:\Program Files\Java\jdk-1.8\lib\update.exe
  "C:\Program Files\Java\jdk-1.8\lib\update.exe" C:\Program Files\Java\jdk-1.8\lib\
  2⤵
  PID:2416

C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe
"C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\
1⤵
PID:2104

C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
1⤵
PID:4920

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\
1⤵
PID:3508

C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\
1⤵
PID:3304

C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\
1⤵
PID:852
- C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\
  2⤵
  PID:1952

C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\
1⤵
PID:388
- C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\
  2⤵
  PID:5104
- C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
  2⤵
  PID:1512
- C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\
  2⤵
  PID:3456
- C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\
  2⤵
  PID:4844
- C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\
  2⤵
  PID:2164
- - C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\
    3⤵
    PID:4204
- C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\
  2⤵
  PID:2636

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\
1⤵
PID:3284

C:\Program Files\Java\jre-1.8\bin\backup.exe
"C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\
1⤵
PID:4808
- C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\
  2⤵
  PID:3468
- C:\Program Files\Java\jre-1.8\bin\server\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\
  2⤵
  PID:1280

C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe
"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
1⤵
PID:4600

C:\Program Files\Java\jre-1.8\lib\backup.exe
"C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\
1⤵
PID:3060
- C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\
  2⤵
  PID:1912
- C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\
  2⤵
  PID:4132
- C:\Program Files\Java\jre-1.8\lib\ext\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\
  2⤵
  PID:2272
- C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\
  2⤵
  PID:1616

C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe
"C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\
1⤵
PID:856

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe
"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\
1⤵
PID:3156

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:3504
- C:\Program Files\Microsoft Office\Office16\backup.exe
  "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
  2⤵
  PID:4380

C:\Program Files\Microsoft Office\root\Client\backup.exe
"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
1⤵
PID:1324

C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
1⤵
PID:2636
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
  2⤵
  PID:3692
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
  2⤵
  PID:1524
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
  2⤵
  PID:1504

C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
"C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
1⤵
PID:1552

C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\
1⤵
PID:4212
- C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\
  2⤵
  PID:1684

C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\
1⤵
PID:696

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\
1⤵
PID:4552
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\
  2⤵
  PID:3160

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\update.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\update.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\
1⤵
PID:4424

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\
1⤵
PID:4496

C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\
1⤵
PID:3912

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\
1⤵
PID:4104

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\update.exe
"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\update.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\
1⤵
PID:848

C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f7\
1⤵
PID:4240

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\
1⤵
PID:1820

C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_w1\
1⤵
PID:4936

C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\
1⤵
PID:5000

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:960

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\
1⤵
PID:4576
- C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\
  2⤵
  PID:3160

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
1⤵
PID:4604

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\
1⤵
PID:4556

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
1⤵
PID:3840

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
1⤵
PID:3376
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
  2⤵
  PID:3384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
1⤵
PID:3608

C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\
1⤵
PID:1604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
1⤵
PID:1436

C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\
1⤵
PID:4536

C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\
1⤵
PID:2788

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\
1⤵
PID:852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
1⤵
PID:2872

C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\
1⤵
PID:376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
1⤵
PID:3804

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\
1⤵
PID:1240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
1⤵
PID:1460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
1⤵
PID:1280

C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\
1⤵
PID:2136

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\
1⤵
PID:4372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
1⤵
PID:3752

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\
1⤵
PID:2860

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\
1⤵
PID:2312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\
1⤵
PID:4548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\
1⤵
PID:4860
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\
  2⤵
  PID:4120

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\
1⤵
PID:4480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\
1⤵
PID:1456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\
1⤵
PID:852

C:\Program Files\Microsoft Office\root\Office16\PROOF\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\PROOF\backup.exe" C:\Program Files\Microsoft Office\root\Office16\PROOF\
1⤵
PID:920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\
1⤵
PID:1168

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\
1⤵
PID:2376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\
1⤵
PID:440

C:\Program Files\Microsoft Office\root\Office16\XLSTART\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\XLSTART\backup.exe" C:\Program Files\Microsoft Office\root\Office16\XLSTART\
1⤵
PID:3896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\
1⤵
PID:4612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\
1⤵
PID:3732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\
1⤵
PID:3752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\
1⤵
PID:1088

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\
1⤵
PID:1960

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\
1⤵
PID:376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\
1⤵
PID:4336

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\
1⤵
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\
1⤵
PID:1640

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\
1⤵
PID:4400

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\
1⤵
PID:1480

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\
1⤵
PID:4936
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\
  2⤵
  PID:4492
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\
  2⤵
  PID:2408
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\
  2⤵
  PID:4496
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\
  2⤵
  PID:4332
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\
  2⤵
  PID:1552

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\
1⤵
PID:1604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\
1⤵
PID:2944

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\
1⤵
PID:1956

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\
1⤵
PID:4848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\
1⤵
PID:1316

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\
1⤵
PID:4240

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\
1⤵
PID:4796

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\
1⤵
PID:3732

C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
"C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
1⤵
PID:4472

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\
1⤵
PID:920
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\
  2⤵
  PID:3188

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe
"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\
1⤵
PID:4848

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\
1⤵
PID:4932

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\
1⤵
PID:4436

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\
1⤵
PID:1936

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\
1⤵
PID:3304
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\
  2⤵
  PID:1720

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\
1⤵
PID:940

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\
1⤵
PID:1088
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\update.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\
  2⤵
  PID:5012
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\
  2⤵
  PID:992
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\
    3⤵
    PID:3408

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:1224

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\
1⤵
PID:436

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\
1⤵
PID:2692

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:5072

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\
1⤵
PID:2572

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\
1⤵
PID:3332

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\
1⤵
PID:848

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:4020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\
1⤵
PID:4696

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\
1⤵
PID:3500

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\
1⤵
PID:4820
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\System Restore.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\
  2⤵
  PID:4972

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System Restore.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:4712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\
1⤵
PID:1932

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:3384

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:4692

C:\Users\Admin\3D Objects\backup.exe
"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
1⤵
PID:2196

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\
1⤵
PID:4920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
1⤵
PID:4796
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
  2⤵
  PID:572
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
    3⤵
    PID:4548

C:\Users\Admin\Desktop\backup.exe
C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
1⤵
PID:4080

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:3644
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System Restore.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:2184
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
  2⤵
  PID:412
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:1720

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
1⤵
PID:4444

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\
1⤵
PID:3496
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\
  2⤵
  PID:2744

C:\Users\Admin\Documents\OneNote Notebooks\backup.exe
"C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\
1⤵
PID:4536
- C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe
  "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\
  2⤵
  PID:2280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\
1⤵
PID:4868

C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
1⤵
PID:4692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\
1⤵
PID:3732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\
1⤵
PID:992

C:\Users\Admin\Links\backup.exe
C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
1⤵
PID:4612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
1⤵
PID:4704

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\
1⤵
PID:3808

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
1⤵
PID:944

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:2852

C:\Users\Admin\OneDrive\backup.exe
C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
1⤵
PID:3220

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
1⤵
PID:700
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
  2⤵
  PID:4012

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:5088
- C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
  2⤵
  PID:2284
- - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
    3⤵
    PID:3992
- C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:828
- - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
    3⤵
    PID:4992
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:5048
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:1164
- C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
  2⤵
  PID:376
- C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
  2⤵
  PID:4216
- C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
  2⤵
  PID:4020
- C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
  2⤵
  PID:4744
- C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
  2⤵
  PID:2856
- - C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
    3⤵
    PID:2540
- C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
  2⤵
  PID:1728
- - C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
    3⤵
    PID:4992
- C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
  2⤵
  PID:1624
- - C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
    3⤵
    PID:4476
- C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
  2⤵
  PID:3476
- - C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
    3⤵
    PID:2872
- C:\Program Files\VideoLAN\VLC\locale\he\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\he\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\he\
  2⤵
  PID:1164
- C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
  2⤵
  PID:3840
- C:\Program Files\VideoLAN\VLC\locale\kab\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kab\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kab\
  2⤵
  PID:1136
- C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
  2⤵
  PID:2540
- C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
  2⤵
  PID:1096
- - C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
    3⤵
    PID:2776
- C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
  2⤵
  PID:3752
- C:\Program Files\VideoLAN\VLC\locale\lt\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\lt\update.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
  2⤵
  PID:4028
- C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
  2⤵
  PID:3652
- C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
  2⤵
  PID:412
- - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
    3⤵
    PID:3984
- C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
  2⤵
  PID:3476
- C:\Program Files\VideoLAN\VLC\locale\mr\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\mr\update.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
  2⤵
  PID:920
- - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
    3⤵
    PID:2840
- C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
  2⤵
  PID:2248
- C:\Program Files\VideoLAN\VLC\locale\my\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\my\data.exe" C:\Program Files\VideoLAN\VLC\locale\my\
  2⤵
  PID:2944
- C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
  2⤵
  PID:3396
- C:\Program Files\VideoLAN\VLC\locale\or_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or_IN\
  2⤵
  PID:1912
- C:\Program Files\VideoLAN\VLC\locale\ps\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\data.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
  2⤵
  PID:2732
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
  2⤵
  PID:3672
- - C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
    3⤵
    PID:944
- C:\Program Files\VideoLAN\VLC\locale\sm\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\sm\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\sm\
  2⤵
  PID:4816
- - C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\
    3⤵
    PID:2072
- C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
  2⤵
  PID:2076
- - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
    3⤵
    PID:856
- C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
  2⤵
  PID:4824
- C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
  2⤵
  PID:1840
- C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
  2⤵
  PID:3992

C:\Users\Admin\Pictures\Camera Roll\backup.exe
"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
1⤵
PID:4324

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\
1⤵
PID:1936
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\
  2⤵
  PID:4612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\
1⤵
PID:3288

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
1⤵
PID:3932
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
  2⤵
  PID:4556
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
  2⤵
  PID:3576

C:\Users\Admin\Pictures\Saved Pictures\backup.exe
"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
1⤵
PID:1676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\
1⤵
PID:4424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\
1⤵
PID:5084

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\
1⤵
PID:1804

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\
1⤵
PID:2808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\
1⤵
PID:2028

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\update.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
1⤵
PID:912

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\
1⤵
PID:4392
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\
  2⤵
  PID:2280

C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\
1⤵
PID:4556

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
1⤵
PID:1168

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\
1⤵
PID:1240

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\
1⤵
PID:3372

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\
1⤵
PID:4848

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
1⤵
PID:4364

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\
1⤵
PID:1732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\
1⤵
PID:1604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\
1⤵
PID:1680

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
1⤵
PID:3144
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
  2⤵
  PID:4492

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\
1⤵
PID:2840

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
1⤵
PID:4820

C:\Windows\apppatch\Custom\Custom64\backup.exe
C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
1⤵
PID:3460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\
1⤵
PID:3508

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:1604

C:\Windows\apppatch\CustomSDB\backup.exe
C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
1⤵
PID:4608

C:\Program Files\Microsoft Office\root\vfs\SystemX86\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\SystemX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\SystemX86\
1⤵
PID:4544

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\
1⤵
PID:3912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\
1⤵
PID:2104

C:\Windows\apppatch\fr-FR\backup.exe
C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
1⤵
PID:4956

C:\Windows\apppatch\it-IT\backup.exe
C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
1⤵
PID:1112

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\System Restore.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\
1⤵
PID:4536

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\
1⤵
PID:1728

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\
1⤵
PID:2184

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\
1⤵
PID:4748

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4868

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
1⤵
PID:380
- C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
  2⤵
  PID:2536

C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\
1⤵
PID:4104
- C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\
  2⤵
  PID:2848
- C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\
  2⤵
  PID:3680

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:3996

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:3932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\
1⤵
PID:3392

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
1⤵
PID:916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\
1⤵
PID:1468

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\
1⤵
PID:3492

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:1936

C:\Windows\assembly\GAC_32\backup.exe
C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\
1⤵
PID:5084
- C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
  C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
  2⤵
  PID:2636
- C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
  C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
  2⤵
  PID:3808
- C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
  2⤵
  PID:2548
- C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
  2⤵
  PID:4904
- - C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1232
- C:\Windows\assembly\GAC_32\MSBuild\backup.exe
  C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
  2⤵
  PID:2068
- C:\Windows\assembly\GAC_32\System.Data\backup.exe
  C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
  2⤵
  PID:1376
- - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
    C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
    3⤵
    PID:4612
- C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
  C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
  2⤵
  PID:4796

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\
1⤵
PID:3804

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\
1⤵
PID:5080
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\
  2⤵
  PID:4476
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\
    3⤵
    PID:1572

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\
1⤵
PID:4788

C:\Program Files (x86)\Common Files\Oracle\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\
1⤵
PID:1460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\
1⤵
PID:4848
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\
  2⤵
  PID:4696
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\
  2⤵
  PID:3796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\
    3⤵
    PID:408

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\
1⤵
PID:4708

C:\Program Files (x86)\Common Files\Services\backup.exe
"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:5028

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
1⤵
PID:4132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\
1⤵
PID:920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\
1⤵
PID:1680

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
1⤵
PID:2028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\
1⤵
PID:3508

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
1⤵
PID:828

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
1⤵
PID:3712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\
1⤵
PID:1504

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\
1⤵
PID:4956

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
1⤵
PID:456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\
1⤵
PID:2872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\
1⤵
PID:1112

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
1⤵
PID:4740

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
1⤵
PID:5048

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
1⤵
PID:2028

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4436

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:388

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\
1⤵
PID:3504

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
1⤵
PID:4604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\
1⤵
PID:3692
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\
  2⤵
  PID:2808
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\
  2⤵
  PID:4336

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
1⤵
PID:1112

C:\Windows\assembly\GAC_64\backup.exe
C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\
1⤵
PID:4440
- C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe
  C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\
  2⤵
  PID:2572
- - C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe
    "C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:3576
- C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
  2⤵
  PID:3864
- - C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:4120
- C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\
  2⤵
  PID:2384
- - C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
    3⤵
    PID:4856
- C:\Windows\assembly\GAC_64\mscorlib\backup.exe
  C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\
  2⤵
  PID:4820
- C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
  C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
  2⤵
  PID:3372
- C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe
  C:\Windows\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\
  2⤵
  PID:1168

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3188

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
1⤵
PID:700

C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe
"C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\System\uk-UA\
1⤵
PID:4536

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
1⤵
PID:4704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\
1⤵
PID:4012

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:3804
- C:\Program Files (x86)\Google\CrashReports\backup.exe
  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
  2⤵
  PID:3720
- C:\Program Files (x86)\Google\Temp\backup.exe
  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
  2⤵
  PID:456
- C:\Program Files (x86)\Google\Update\backup.exe
  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
  2⤵
  PID:2580

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\
1⤵
PID:4992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\
1⤵
PID:4392

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\
1⤵
PID:4808

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4376

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\
1⤵
PID:4664

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\
1⤵
PID:4600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\
1⤵
PID:2812

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\
1⤵
PID:3712

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
1⤵
PID:956

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\
1⤵
PID:3476

C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\
1⤵
PID:4800

C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
1⤵
PID:3392

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
1⤵
PID:4480

C:\Program Files (x86)\Internet Explorer\es-ES\System Restore.exe
"C:\Program Files (x86)\Internet Explorer\es-ES\System Restore.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
1⤵
PID:4728

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:1504
- C:\Program Files\Windows Defender\de-DE\backup.exe
  "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
  2⤵
  PID:4136

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
1⤵
PID:1912

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:3808
- C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
  2⤵
  PID:1720
- C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
  2⤵
  PID:3504

C:\Program Files (x86)\Microsoft\Edge\System Restore.exe
"C:\Program Files (x86)\Microsoft\Edge\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\
1⤵
PID:4376

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\
1⤵
PID:336

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:3160

C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
1⤵
PID:1528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
1⤵
PID:3652

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
1⤵
PID:1440

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
1⤵
PID:3896
- C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4604

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:4956

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:1444

C:\Program Files\Windows Media Player\es-ES\backup.exe
"C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
1⤵
PID:3284

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:960

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\
1⤵
PID:388

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\
1⤵
PID:5024

C:\Program Files\Windows Media Player\fr-FR\backup.exe
"C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:412

C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
1⤵
PID:3372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\
1⤵
PID:4688

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:4536

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2612

C:\Program Files\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
1⤵
PID:3476

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:3280

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\
1⤵
PID:4800

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:3840

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\
1⤵
PID:3120

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:3284

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\
1⤵
PID:688

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
1⤵
PID:4224
- C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\
1⤵
PID:3304

C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
1⤵
PID:992

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\
1⤵
PID:644

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:3680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\
1⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\
1⤵
PID:1096

C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
1⤵
PID:4104

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\
1⤵
PID:2280

C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\
1⤵
PID:1808

C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\
1⤵
PID:3396

C:\Windows\bcastdvr\backup.exe
C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
1⤵
PID:3160

C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
1⤵
PID:5028

C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4272

C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
"C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
1⤵
PID:3852

C:\Windows\Branding\backup.exe
C:\Windows\Branding\backup.exe C:\Windows\Branding\
1⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\
1⤵
PID:4476

C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
1⤵
PID:4132

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\
1⤵
PID:956
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1060
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4572

C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe
"C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files\Windows Photo Viewer\ja-JP\
1⤵
PID:3112

C:\Windows\Branding\Basebrd\es-ES\backup.exe
C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\
1⤵
PID:680

C:\Windows\Branding\Basebrd\fr-FR\backup.exe
C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
1⤵
PID:1460

C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
1⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\
1⤵
PID:3420

C:\Windows\Branding\Basebrd\it-IT\backup.exe
C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
1⤵
PID:4248

C:\Windows\Branding\Basebrd\ja-JP\backup.exe
C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\
1⤵
PID:3672

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\
1⤵
PID:4476

C:\Program Files\Windows Security\BrowserCore\en-US\backup.exe
"C:\Program Files\Windows Security\BrowserCore\en-US\backup.exe" C:\Program Files\Windows Security\BrowserCore\en-US\
1⤵
PID:408

C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\
1⤵
PID:1972

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\
1⤵
PID:4792

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\
1⤵
PID:1236

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1444

C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\mux\
1⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\
1⤵
PID:2592

C:\Program Files\VideoLAN\VLC\plugins\packetizer\data.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\data.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:3188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\
1⤵
PID:4676

C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
1⤵
PID:4740

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\
1⤵
PID:4972

C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\spu\
1⤵
PID:3864

C:\Windows\Containers\serviced\backup.exe
C:\Windows\Containers\serviced\backup.exe C:\Windows\Containers\serviced\
1⤵
PID:2384

C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\
1⤵
PID:1604

C:\Windows\Cursors\backup.exe
C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
1⤵
PID:5000

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:3576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\
1⤵
PID:3304

C:\Windows\de-DE\backup.exe
C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
1⤵
PID:4712

C:\Windows\DiagTrack\backup.exe
C:\Windows\DiagTrack\backup.exe C:\Windows\DiagTrack\
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\
1⤵
PID:1524
- C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\data.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\data.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\
  2⤵
  PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\backup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\
    3⤵
    PID:4304

C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_chroma\
1⤵
PID:2956

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:3840

C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
1⤵
PID:1164

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\
1⤵
PID:3388

C:\Windows\DigitalLocker\backup.exe
C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
1⤵
PID:1608

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:1480

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:3652

C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_splitter\
1⤵
PID:4708

C:\Windows\en-US\backup.exe
C:\Windows\en-US\backup.exe C:\Windows\en-US\
1⤵
PID:1912

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\System Restore.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\System Restore.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
1⤵
PID:1432

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\
1⤵
PID:4452

C:\Windows\Globalization\ELS\backup.exe
C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
1⤵
PID:2592

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:1616

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\
1⤵
PID:4232

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:4860

C:\Windows\Globalization\Sorting\update.exe
C:\Windows\Globalization\Sorting\update.exe C:\Windows\Globalization\Sorting\
1⤵
PID:4020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\
1⤵
PID:4788

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:5024

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\
1⤵
PID:4160
- C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\
  2⤵
  PID:4312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\
1⤵
PID:1432
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\
  2⤵
  PID:3840

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\
1⤵
PID:1236

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
1⤵
PID:3372

C:\Windows\Help\Help\backup.exe
C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
1⤵
PID:4736

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:2632

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\
1⤵
PID:3852

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:4708

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:1316

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\
1⤵
PID:4788

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\
1⤵
PID:3332

C:\Windows\Help\mui\0407\backup.exe
C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
1⤵
PID:4692

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:3220

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2212

C:\Windows\Help\mui\040C\update.exe
C:\Windows\Help\mui\040C\update.exe C:\Windows\Help\mui\040C\
1⤵
PID:4132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\
1⤵
PID:4224

C:\Windows\Help\mui\0410\backup.exe
C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\
1⤵
PID:1720

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:696

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
1⤵
PID:1964

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\
1⤵
PID:4208

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\
1⤵
PID:2396

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\
1⤵
PID:4892
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:4712

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\
1⤵
PID:680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\
1⤵
PID:4044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\
1⤵
PID:4572

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\
1⤵
PID:1376

C:\Windows\Help\Windows\backup.exe
C:\Windows\Help\Windows\backup.exe C:\Windows\Help\Windows\
1⤵
PID:572
- C:\Windows\Help\Windows\ContentStore\update.exe
  C:\Windows\Help\Windows\ContentStore\update.exe C:\Windows\Help\Windows\ContentStore\
  2⤵
  PID:4232
- C:\Windows\Help\Windows\IndexStore\System Restore.exe
  "C:\Windows\Help\Windows\IndexStore\System Restore.exe" C:\Windows\Help\Windows\IndexStore\
  2⤵
  PID:2416

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\
1⤵
PID:1608

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:4744

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\
1⤵
PID:1316

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:956

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\
1⤵
PID:1364

C:\Windows\IdentityCRL\data.exe
C:\Windows\IdentityCRL\data.exe C:\Windows\IdentityCRL\
1⤵
PID:3016
- C:\Windows\IdentityCRL\INT\backup.exe
  C:\Windows\IdentityCRL\INT\backup.exe C:\Windows\IdentityCRL\INT\
  2⤵
  PID:436

C:\Program Files (x86)\Windows Defender\backup.exe
"C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\
1⤵
PID:1752
- C:\Program Files (x86)\Windows Defender\de-DE\System Restore.exe
  "C:\Program Files (x86)\Windows Defender\de-DE\System Restore.exe" C:\Program Files (x86)\Windows Defender\de-DE\
  2⤵
  PID:5024
- C:\Program Files (x86)\Windows Defender\it-IT\System Restore.exe
  "C:\Program Files (x86)\Windows Defender\it-IT\System Restore.exe" C:\Program Files (x86)\Windows Defender\it-IT\
  2⤵
  PID:4320

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:3424

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\
1⤵
PID:4124

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a3a54d1c0d022e4ccf266b954fe01230\
1⤵
PID:2808

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\
1⤵
PID:4376

C:\Windows\IME\en-US\System Restore.exe
"C:\Windows\IME\en-US\System Restore.exe" C:\Windows\IME\en-US\
1⤵
PID:4020

C:\Program Files (x86)\Windows Mail\backup.exe
"C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\
1⤵
PID:4632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\
1⤵
PID:2944

C:\Windows\IME\IMEJP\System Restore.exe
"C:\Windows\IME\IMEJP\System Restore.exe" C:\Windows\IME\IMEJP\
1⤵
PID:4048
- C:\Windows\IME\IMEJP\help\backup.exe
  C:\Windows\IME\IMEJP\help\backup.exe C:\Windows\IME\IMEJP\help\
  2⤵
  PID:3188

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\
1⤵
PID:2844

C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe
"C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
1⤵
PID:4492

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:4452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\
1⤵
PID:1164

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\
1⤵
PID:2956

C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
1⤵
PID:2136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\
1⤵
PID:2280

C:\Windows\IME\IMEKR\backup.exe
C:\Windows\IME\IMEKR\backup.exe C:\Windows\IME\IMEKR\
1⤵
PID:1752
- C:\Windows\IME\IMEKR\HELP\backup.exe
  C:\Windows\IME\IMEKR\HELP\backup.exe C:\Windows\IME\IMEKR\HELP\
  2⤵
  PID:916

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\
1⤵
PID:4232
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\
  2⤵
  PID:2396
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\
  2⤵
  PID:1480

C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\
1⤵
PID:680

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\
1⤵
PID:4792

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:4844

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
1⤵
PID:644

C:\Windows\IME\IMETC\DICTS\System Restore.exe
"C:\Windows\IME\IMETC\DICTS\System Restore.exe" C:\Windows\IME\IMETC\DICTS\
1⤵
PID:4248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\
1⤵
PID:2088

C:\Program Files (x86)\Windows Media Player\uk-UA\data.exe
"C:\Program Files (x86)\Windows Media Player\uk-UA\data.exe" C:\Program Files (x86)\Windows Media Player\uk-UA\
1⤵
PID:2104

C:\Windows\IME\IMETC\HELP\data.exe
C:\Windows\IME\IMETC\HELP\data.exe C:\Windows\IME\IMETC\HELP\
1⤵
PID:940

C:\Windows\IME\it-IT\backup.exe
C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
1⤵
PID:1728

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\
1⤵
PID:3720

C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\en-US\
1⤵
PID:380

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\
1⤵
PID:4160

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\
1⤵
PID:3808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\
1⤵
PID:3396

C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
1⤵
PID:4444

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\
1⤵
PID:4472

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
1⤵
PID:1432
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4084

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\
1⤵
PID:4800

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:4548

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\
1⤵
PID:4172

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\
1⤵
PID:3700

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\
1⤵
PID:2408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\
1⤵
PID:4536
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\
  2⤵
  PID:4204

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\
1⤵
PID:3416

C:\Windows\INF\update.exe
C:\Windows\INF\update.exe C:\Windows\INF\
1⤵
PID:4480
- C:\Windows\INF\ESENT\backup.exe
  C:\Windows\INF\ESENT\backup.exe C:\Windows\INF\ESENT\
  2⤵
  PID:1524
- - C:\Windows\INF\ESENT\0407\backup.exe
    C:\Windows\INF\ESENT\0407\backup.exe C:\Windows\INF\ESENT\0407\
    3⤵
    PID:4060
- - C:\Windows\INF\ESENT\0409\backup.exe
    C:\Windows\INF\ESENT\0409\backup.exe C:\Windows\INF\ESENT\0409\
    3⤵
    PID:4364
- - C:\Windows\INF\ESENT\0411\backup.exe
    C:\Windows\INF\ESENT\0411\backup.exe C:\Windows\INF\ESENT\0411\
    3⤵
    PID:3384
- - C:\Windows\INF\ESENT\0C0A\backup.exe
    C:\Windows\INF\ESENT\0C0A\backup.exe C:\Windows\INF\ESENT\0C0A\
    3⤵
    PID:1440
- C:\Windows\INF\MSDTC\backup.exe
  C:\Windows\INF\MSDTC\backup.exe C:\Windows\INF\MSDTC\
  2⤵
  PID:2800
- - C:\Windows\INF\MSDTC\0409\backup.exe
    C:\Windows\INF\MSDTC\0409\backup.exe C:\Windows\INF\MSDTC\0409\
    3⤵
    PID:1448
- C:\Windows\INF\MSDTC Bridge 4.0.0.0\backup.exe
  "C:\Windows\INF\MSDTC Bridge 4.0.0.0\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\
  2⤵
  PID:4704
- - C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe
    "C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\
    3⤵
    PID:4912
- C:\Windows\INF\ServiceModelOperation 3.0.0.0\backup.exe
  "C:\Windows\INF\ServiceModelOperation 3.0.0.0\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\
  2⤵
  PID:3424
- - C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\backup.exe
    "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\
    3⤵
    PID:3992
- - C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\backup.exe
    "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\
    3⤵
    PID:412
- - C:\Windows\INF\ServiceModelOperation 3.0.0.0\0409\update.exe
    "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0409\update.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0409\
    3⤵
    PID:700
- - C:\Windows\INF\ServiceModelOperation 3.0.0.0\0C0A\backup.exe
    "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0C0A\
    3⤵
    PID:4720
- C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe
  "C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\
  2⤵
  PID:4216
- - C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe
    "C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\0411\
    3⤵
    PID:3720
- - C:\Windows\INF\SMSvcHost 4.0.0.0\0C0A\backup.exe
    "C:\Windows\INF\SMSvcHost 4.0.0.0\0C0A\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\0C0A\
    3⤵
    PID:2416
- C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\backup.exe
  "C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\
  2⤵
  PID:4492
- C:\Windows\INF\wsearchidxpi\backup.exe
  C:\Windows\INF\wsearchidxpi\backup.exe C:\Windows\INF\wsearchidxpi\
  2⤵
  PID:4744
- - C:\Windows\INF\wsearchidxpi\0000\backup.exe
    C:\Windows\INF\wsearchidxpi\0000\backup.exe C:\Windows\INF\wsearchidxpi\0000\
    3⤵
    PID:1912
- - C:\Windows\INF\wsearchidxpi\040C\backup.exe
    C:\Windows\INF\wsearchidxpi\040C\backup.exe C:\Windows\INF\wsearchidxpi\040C\
    3⤵
    PID:4540
- - C:\Windows\INF\wsearchidxpi\0411\backup.exe
    C:\Windows\INF\wsearchidxpi\0411\backup.exe C:\Windows\INF\wsearchidxpi\0411\
    3⤵
    PID:5100
- - C:\Windows\INF\wsearchidxpi\0C0A\backup.exe
    C:\Windows\INF\wsearchidxpi\0C0A\backup.exe C:\Windows\INF\wsearchidxpi\0C0A\
    3⤵
    PID:1288

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\
1⤵
PID:1288

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
1⤵
PID:4720
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\System Restore.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\System Restore.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\
  2⤵
  PID:1096
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\
  2⤵
  PID:2184

C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\uk-UA\
1⤵
PID:2196

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:1824

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\
1⤵
PID:452

C:\Windows\INF\BITS\0407\backup.exe
C:\Windows\INF\BITS\0407\backup.exe C:\Windows\INF\BITS\0407\
1⤵
PID:2384

C:\Windows\INF\BITS\0409\backup.exe
C:\Windows\INF\BITS\0409\backup.exe C:\Windows\INF\BITS\0409\
1⤵
PID:3924

C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\
1⤵
PID:2572

C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\
1⤵
PID:3316

C:\Windows\INF\BITS\0C0A\data.exe
C:\Windows\INF\BITS\0C0A\data.exe C:\Windows\INF\BITS\0C0A\
1⤵
PID:1504

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\
1⤵
PID:4608

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\
1⤵
PID:2824
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:756
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:2944

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\
1⤵
PID:4272
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\
  2⤵
  PID:376

C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\
1⤵
PID:4572
- C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\
  2⤵
  PID:3376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\
1⤵
PID:4332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\
1⤵
PID:4476

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\
1⤵
PID:3052

C:\Windows\INF\LSM\0407\backup.exe
C:\Windows\INF\LSM\0407\backup.exe C:\Windows\INF\LSM\0407\
1⤵
PID:532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\
1⤵
PID:3560

C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\
1⤵
PID:1376

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\
1⤵
PID:1616

C:\Windows\INF\LSM\0409\backup.exe
C:\Windows\INF\LSM\0409\backup.exe C:\Windows\INF\LSM\0409\
1⤵
PID:4924

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\
1⤵
PID:1192

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
1⤵
PID:4600
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\
  2⤵
  PID:4004
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\
    3⤵
    PID:4080

C:\Windows\INF\LSM\0411\backup.exe
C:\Windows\INF\LSM\0411\backup.exe C:\Windows\INF\LSM\0411\
1⤵
PID:2980

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\
1⤵
PID:2536

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2844

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\
1⤵
PID:2312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\
1⤵
PID:3888

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\
1⤵
PID:2184
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\
  2⤵
  PID:336
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\
    3⤵
    PID:744

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\
1⤵
PID:3608
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\data.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\
  2⤵
  PID:3492

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\
1⤵
PID:2296

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\
1⤵
PID:4924

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\
1⤵
PID:4224

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\
1⤵
PID:4232

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\
1⤵
PID:3732

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\
1⤵
PID:4712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\
1⤵
PID:4452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\
1⤵
PID:2612

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\
1⤵
PID:2948

C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\backup.exe
"C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\
1⤵
PID:1680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\
1⤵
PID:3852

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\
1⤵
PID:4284

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\
1⤵
PID:2196
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\
  2⤵
  PID:4800

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\
1⤵
PID:5084

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\
1⤵
PID:3924
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\
  2⤵
  PID:1136

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:208

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\
1⤵
PID:1224

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:4644

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\
1⤵
PID:4816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\
1⤵
PID:4904

C:\Windows\INF\PERFLIB\0407\backup.exe
C:\Windows\INF\PERFLIB\0407\backup.exe C:\Windows\INF\PERFLIB\0407\
1⤵
PID:4084

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\
1⤵
PID:1664

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\1caf21ddd9d36b549ff0ac875be2b8b4\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\1caf21ddd9d36b549ff0ac875be2b8b4\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\1caf21ddd9d36b549ff0ac875be2b8b4\
1⤵
PID:440

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\
1⤵
PID:3408

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4992

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\
1⤵
PID:4124

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\
1⤵
PID:1964

C:\Windows\INF\PERFLIB\0410\backup.exe
C:\Windows\INF\PERFLIB\0410\backup.exe C:\Windows\INF\PERFLIB\0410\
1⤵
PID:3680

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\
1⤵
PID:5088

C:\Windows\INF\PERFLIB\0C0A\backup.exe
C:\Windows\INF\PERFLIB\0C0A\backup.exe C:\Windows\INF\PERFLIB\0C0A\
1⤵
PID:1060

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:856

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\
1⤵
PID:1096

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\
1⤵
PID:4712

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4336

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\
1⤵
PID:4028

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\
1⤵
PID:3648

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\update.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\update.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\
1⤵
PID:660

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\System Restore.exe
"C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\
1⤵
PID:2408

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\
1⤵
PID:3840

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\
1⤵
PID:3992

C:\Windows\INF\PNRPSvc\040C\backup.exe
C:\Windows\INF\PNRPSvc\040C\backup.exe C:\Windows\INF\PNRPSvc\040C\
1⤵
PID:3852

C:\Windows\INF\PNRPSvc\0410\update.exe
C:\Windows\INF\PNRPSvc\0410\update.exe C:\Windows\INF\PNRPSvc\0410\
1⤵
PID:4136

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\
1⤵
PID:1164

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\
1⤵
PID:1448

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4924

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\
1⤵
PID:700

C:\Windows\INF\PNRPSvc\0C0A\backup.exe
C:\Windows\INF\PNRPSvc\0C0A\backup.exe C:\Windows\INF\PNRPSvc\0C0A\
1⤵
PID:4688

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\
1⤵
PID:400

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\
1⤵
PID:3376

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\
1⤵
PID:1960
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\
  2⤵
  PID:1972

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\
1⤵
PID:1552

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\
1⤵
PID:4420

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\
1⤵
PID:1912

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\
1⤵
PID:4272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\
1⤵
PID:3016

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\
1⤵
PID:2408
- C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\
  2⤵
  PID:3896

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\
1⤵
PID:224
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:2420

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\6de9117021f804bd643639bb684ffe6f\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\6de9117021f804bd643639bb684ffe6f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\6de9117021f804bd643639bb684ffe6f\
1⤵
PID:3808

C:\Windows\INF\rdyboost\0C0A\backup.exe
C:\Windows\INF\rdyboost\0C0A\backup.exe C:\Windows\INF\rdyboost\0C0A\
1⤵
PID:4816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\
1⤵
PID:1164

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\69042cc33a9bcc563ab9ff90a7276b2c\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\69042cc33a9bcc563ab9ff90a7276b2c\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\69042cc33a9bcc563ab9ff90a7276b2c\
1⤵
PID:3752

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\09b91f03d16fc39bc49c0ed85b6903a2\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\09b91f03d16fc39bc49c0ed85b6903a2\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\09b91f03d16fc39bc49c0ed85b6903a2\
1⤵
PID:680

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4#\6459bee197ed2b8e5576f10cb8b39a32\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4#\6459bee197ed2b8e5576f10cb8b39a32\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4#\6459bee197ed2b8e5576f10cb8b39a32\
1⤵
PID:4364

C:\Windows\INF\RemoteAccess\0411\backup.exe
C:\Windows\INF\RemoteAccess\0411\backup.exe C:\Windows\INF\RemoteAccess\0411\
1⤵
PID:4584

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\
1⤵
PID:2184

C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0000\backup.exe
"C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0000\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0000\
1⤵
PID:3508

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\
1⤵
PID:4312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\
1⤵
PID:3652

C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\backup.exe
"C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\
1⤵
PID:4392

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:3460

C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\
1⤵
PID:4332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\
1⤵
PID:1316

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\
1⤵
PID:944
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\
1⤵
PID:3016

C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\System Restore.exe
"C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\
1⤵
PID:912
- C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\
  2⤵
  PID:3680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\
1⤵
PID:1440

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:1824

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\
1⤵
PID:4972

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\
1⤵
PID:4716

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\
1⤵
PID:3280

C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\
1⤵
PID:2168

C:\Windows\INF\ServiceModelService 3.0.0.0\0000\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0000\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0000\
1⤵
PID:5000

C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\085cda9eebdee4ba67ebbcfb4dfa8c85\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\085cda9eebdee4ba67ebbcfb4dfa8c85\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\085cda9eebdee4ba67ebbcfb4dfa8c85\
1⤵
PID:384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\
1⤵
PID:4956

C:\Windows\INF\ServiceModelService 3.0.0.0\040C\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\040C\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\040C\
1⤵
PID:2800

C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\
1⤵
PID:3392

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1080

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\
1⤵
PID:4860

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\
1⤵
PID:2872

C:\Windows\INF\SMSvcHost 3.0.0.0\0410\backup.exe
"C:\Windows\INF\SMSvcHost 3.0.0.0\0410\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0410\
1⤵
PID:5000

C:\Windows\INF\SMSvcHost 3.0.0.0\0411\backup.exe
"C:\Windows\INF\SMSvcHost 3.0.0.0\0411\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0411\
1⤵
PID:1972

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\
1⤵
PID:3492

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\
1⤵
PID:3576

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:224

C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe
"C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\
1⤵
PID:384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\
1⤵
PID:2072

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\
1⤵
PID:4444
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:412

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\
1⤵
PID:636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\
1⤵
PID:4928

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\
1⤵
PID:856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\
1⤵
PID:1440

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\
1⤵
PID:3188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\
1⤵
PID:852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\
1⤵
PID:4304

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\
1⤵
PID:2948

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\
1⤵
PID:4716

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\
1⤵
PID:1664

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\
1⤵
PID:2196

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\
1⤵
PID:4052

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\
1⤵
PID:2864

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\
1⤵
PID:2212

C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\
1⤵
PID:4216

C:\Windows\INF\TermService\0C0A\data.exe
C:\Windows\INF\TermService\0C0A\data.exe C:\Windows\INF\TermService\0C0A\
1⤵
PID:2776

C:\Windows\Logs\DISM\backup.exe
C:\Windows\Logs\DISM\backup.exe C:\Windows\Logs\DISM\
1⤵
PID:4120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\
1⤵
PID:2696

C:\Windows\INF\UGatherer\0000\backup.exe
C:\Windows\INF\UGatherer\0000\backup.exe C:\Windows\INF\UGatherer\0000\
1⤵
PID:3576

C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\
1⤵
PID:1728

C:\Windows\Logs\SIH\backup.exe
C:\Windows\Logs\SIH\backup.exe C:\Windows\Logs\SIH\
1⤵
PID:932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\
1⤵
PID:4952

C:\Windows\Microsoft.NET\backup.exe
C:\Windows\Microsoft.NET\backup.exe C:\Windows\Microsoft.NET\
1⤵
PID:2516
- C:\Windows\Microsoft.NET\assembly\System Restore.exe
  "C:\Windows\Microsoft.NET\assembly\System Restore.exe" C:\Windows\Microsoft.NET\assembly\
  2⤵
  PID:2916
- - C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe
    C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\
    3⤵
    PID:2244
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\
      4⤵
      PID:4172
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\
      4⤵
      PID:4332
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\System Restore.exe
      "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\
      4⤵
      PID:3720
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:2196
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\
      4⤵
      PID:632
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:992
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\
      4⤵
      PID:3924
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
        5⤵
        
        PID:2272
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
      4⤵
      PID:4728
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:4904
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\
      4⤵
      PID:3984
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:4848
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\data.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\data.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\
      4⤵
      PID:3932
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\System Restore.exe
        
        "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\
        5⤵
        
        PID:3220
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
        5⤵
        
        PID:384
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
      4⤵
      PID:1600
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\System Restore.exe
      "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\
      4⤵
      PID:3984
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:4048
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\
      4⤵
      PID:3692
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
      C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\
      4⤵
      PID:400
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\backup.exe
        
        C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\
        5⤵
        
        PID:1448
  - - C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe
      "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\
      4⤵
      PID:3500

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb#\ace0ccf90f3ff2439a125417206b62ff\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb#\ace0ccf90f3ff2439a125417206b62ff\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb#\ace0ccf90f3ff2439a125417206b62ff\
1⤵
PID:3668

C:\Windows\INF\UGTHRSVC\0000\backup.exe
C:\Windows\INF\UGTHRSVC\0000\backup.exe C:\Windows\INF\UGTHRSVC\0000\
1⤵
PID:3736

C:\Windows\INF\UGTHRSVC\0407\backup.exe
C:\Windows\INF\UGTHRSVC\0407\backup.exe C:\Windows\INF\UGTHRSVC\0407\
1⤵
PID:572

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\
1⤵
PID:3992
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9dc8ecabf3587fd779eed1e7c1376c22\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9dc8ecabf3587fd779eed1e7c1376c22\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9dc8ecabf3587fd779eed1e7c1376c22\
  2⤵
  PID:684

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\
1⤵
PID:5088
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1804

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\
1⤵
PID:2184

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\
1⤵
PID:4136

C:\Windows\INF\UGTHRSVC\0409\backup.exe
C:\Windows\INF\UGTHRSVC\0409\backup.exe C:\Windows\INF\UGTHRSVC\0409\
1⤵
PID:3384

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\cc60c54c3dde798a43317ec502c0ca47\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\cc60c54c3dde798a43317ec502c0ca47\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\cc60c54c3dde798a43317ec502c0ca47\
1⤵
PID:1240

C:\Windows\INF\UGTHRSVC\0410\backup.exe
C:\Windows\INF\UGTHRSVC\0410\backup.exe C:\Windows\INF\UGTHRSVC\0410\
1⤵
PID:3712

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\
1⤵
PID:4808

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\
1⤵
PID:1356

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4248

C:\Windows\INF\UGTHRSVC\0C0A\backup.exe
C:\Windows\INF\UGTHRSVC\0C0A\backup.exe C:\Windows\INF\UGTHRSVC\0C0A\
1⤵
PID:4004

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\
1⤵
PID:552

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\
1⤵
PID:944

C:\Windows\INF\usbhub\040C\backup.exe
C:\Windows\INF\usbhub\040C\backup.exe C:\Windows\INF\usbhub\040C\
1⤵
PID:3896

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\
1⤵
PID:616

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\
1⤵
PID:5080

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:4320

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2076

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\
1⤵
PID:3712
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2332
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:920
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1680
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1960

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\
1⤵
PID:2864

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\
1⤵
PID:3504

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\
1⤵
PID:3864

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0409\data.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0409\data.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0409\
1⤵
PID:3644

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\
1⤵
PID:2800
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\c15be34a937f1a0f06596ffb8e106ea0\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\c15be34a937f1a0f06596ffb8e106ea0\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\c15be34a937f1a0f06596ffb8e106ea0\
  2⤵
  PID:4528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\
1⤵
PID:3668

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\
1⤵
PID:4860

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0410\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0410\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0410\
1⤵
PID:916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\
1⤵
PID:3332

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0C0A\
1⤵
PID:3188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\
1⤵
PID:1316

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\
1⤵
PID:4304

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\
1⤵
PID:4088

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:992

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\f577ef2b3b341c57f4b7eb23478be457\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\f577ef2b3b341c57f4b7eb23478be457\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\f577ef2b3b341c57f4b7eb23478be457\
1⤵
PID:4520

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\
1⤵
PID:1248

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1808

C:\Windows\assembly\GAC_MSIL\MMCFxCommon\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon\
1⤵
PID:1456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\
1⤵
PID:940
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\
  2⤵
  PID:4536
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\
    3⤵
    PID:4172

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\
1⤵
PID:4284
- C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:4576
- C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:3112
- C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:2948

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\
1⤵
PID:5024

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:3932

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\
1⤵
PID:1640

C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\
1⤵
PID:744
- C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_es_b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_es_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_es_b77a5c561934e089\
  2⤵
  PID:4212
- C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_it_b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_it_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_it_b77a5c561934e089\
  2⤵
  PID:4324

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:616

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\
1⤵
PID:3328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\
1⤵
PID:3664

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\
1⤵
PID:3808

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\data.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:4600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\
1⤵
PID:4552

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\
1⤵
PID:3284

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2280

C:\Windows\assembly\GAC_MSIL\office\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\office\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\office\15.0.0.0__71e9bce111e9429c\
1⤵
PID:2132

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\
1⤵
PID:4028

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:4084

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\
1⤵
PID:2848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\
1⤵
PID:3052

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pad0e0718#\4c01b83715593dfea330357f18075ea2\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pad0e0718#\4c01b83715593dfea330357f18075ea2\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pad0e0718#\4c01b83715593dfea330357f18075ea2\
1⤵
PID:532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\
1⤵
PID:3504

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\
1⤵
PID:4540

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\
1⤵
PID:380

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\
1⤵
PID:5028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\
1⤵
PID:3388

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\
1⤵
PID:1444

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\
1⤵
PID:4204
- C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2188

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\
1⤵
PID:4084
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\
  2⤵
  PID:572

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\
1⤵
PID:3052

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\
1⤵
PID:3328

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\
1⤵
PID:3376

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\
1⤵
PID:2696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\
1⤵
PID:4556

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\
1⤵
PID:3332

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:4608

C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4632

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\1d15088f501797022a5f51a0cde8576d\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\1d15088f501797022a5f51a0cde8576d\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\1d15088f501797022a5f51a0cde8576d\
1⤵
PID:2284

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\
1⤵
PID:4384

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4900

C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:1240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\
1⤵
PID:384

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\677c75c2bda4bd3c926237a7a0224b43\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\677c75c2bda4bd3c926237a7a0224b43\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\677c75c2bda4bd3c926237a7a0224b43\
1⤵
PID:3648

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207#\6c6b5e42d2883b18fa1ce25d63405a98\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207#\6c6b5e42d2883b18fa1ce25d63405a98\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207#\6c6b5e42d2883b18fa1ce25d63405a98\
1⤵
PID:212

C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:5072

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4004

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\
1⤵
PID:2088

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\update.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\
1⤵
PID:1604

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\
1⤵
PID:2028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\
1⤵
PID:4644

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\
1⤵
PID:5052
- C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:3576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\
1⤵
PID:1624
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\
  2⤵
  PID:3796

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\
1⤵
PID:2844

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\
1⤵
PID:3680
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\update.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\
  2⤵
  PID:4992

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:5100

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\22cbcb640b1d17e45820978a43df89f3\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\22cbcb640b1d17e45820978a43df89f3\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\22cbcb640b1d17e45820978a43df89f3\
1⤵
PID:4608

C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\15.0.0.0__71e9bce111e9429c\
1⤵
PID:388

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\
1⤵
PID:384

C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\
1⤵
PID:3284

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\System Restore.exe
"C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\
1⤵
PID:2948

C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1616

C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4440

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\
1⤵
PID:4424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\
1⤵
PID:2892

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\update.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:3200

C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
1⤵
PID:380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\
1⤵
PID:3896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\
1⤵
PID:636

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602#\d77c7cb3b6e6077482cef984478fe82c\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602#\d77c7cb3b6e6077482cef984478fe82c\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602#\d77c7cb3b6e6077482cef984478fe82c\
1⤵
PID:2408

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\
1⤵
PID:4632

C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:4704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\
1⤵
PID:3924

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4520

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:3424

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\
1⤵
PID:1912
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\13c05011af74e0c3a6303b3a20f755ba\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\13c05011af74e0c3a6303b3a20f755ba\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\13c05011af74e0c3a6303b3a20f755ba\
  2⤵
  PID:4256

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\
1⤵
PID:4676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\
1⤵
PID:616

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:4160

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\
1⤵
PID:2840
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\
  2⤵
  PID:4444

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:4452

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\c379c3f4f210c165aea500d0f8f667ca\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\c379c3f4f210c165aea500d0f8f667ca\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\c379c3f4f210c165aea500d0f8f667ca\
1⤵
PID:4136

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2136

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\update.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\
1⤵
PID:4876

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:4480

C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_it_31bf3856ad364e35\
1⤵
PID:3804

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:4304

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\
1⤵
PID:1340
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\
  2⤵
  PID:4376

C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\backup.exe
C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\backup.exe C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\
1⤵
PID:1096

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\data.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:2296

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\
1⤵
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

backup.exe

Path C:\PerfLogs\backup.exe
Size 72KB
SHA256 2bb2b584d1f23c5066f0364118c58f552dfde6353a82d6488e5379c827a72687
MD5 cd7d7f9199d0d94e95ba7abb3fe89644
SHA1 9e953ab623a12e1593301ffaccf001ed4392ffe1
SHA512 8a73be9f56400ceeb99b3c16ada7e1f0d9d82a09e469d61c5632eea312751a68b0f370a27042609ffa0f83cbe80bf093abf71c086b72fffb0bf5d426b7d14da7
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2C:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Program Files\7-Zip\Lang\backup.exe
Size 72KB
SHA256 16a9aa09ba1f1ac3e194a4c0b13a19d2dd4b2af110c5229eed51e8c6e6ac91d8
MD5 cfcedb6b6902a33ad11ee64eb7a189a6
SHA1 5a308e9a612eb25e19b16a75327da495398b03d5
SHA512 e6976cd5f11d15ee7f4a760f09764a54850ee8fe41babbd29dd382eda572d111713b501c68f3aaa7f23e80327e3c3c1b426f74e49e4f102256eb97165e00ba5e
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2i:ypQNwC3BEddsEqOt/hyJF+x3BEJwRru
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
Size 72KB
SHA256 f0ec7cf566d1e0d75690dad3eff7c4968270f76ae73889043346d509c21b08bf
MD5 afd9eed8b363893db323f3883dd24500
SHA1 fb6e0f09e5c38913e7641653cd3cc73ef0b82f3e
SHA512 8c65fa32cc2352180949c06b46837ddef32478d502753892d0fcf5bb409a8c28f76a6c5e3023260e8e1387a09dab7f61f5baf22c267d75276024dc554e80f5e0
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2u:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
Size 72KB
SHA256 2636c028c66703fdf86233006f7d9d333fa0334bf79c3ee3f8baf1d817f68e74
MD5 e431d5165d133b8796e559c0993ab0e9
SHA1 bc00f7df241b39a6ec3aa1c0b3a2391bff18142a
SHA512 d9baecf56900ca79d21329d21984cb91130ff17354d7262398603777fcefc9c8fe0cf9ab41c78c79943cf0739405f219a09ef40f57bbf742ece1c7bdce5cd569
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2C:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
Size 72KB
SHA256 b2621ace823c418f4df01917b65375d452b29f717d07be41c8303dd50dd91ed3
MD5 7c3037e7529026d54085625629beff6d
SHA1 1e01c72f1db11f7bdbadfb939092acc6d0245b05
SHA512 9d8b1cfa838d6cc311a4c27d2b29156dd75c6e0d0634c53c053afda1ae81ebd3f07ec5a6b37d8b92b4f7059dee89264510ab4dbe06fc7589ef475e2043de6e67
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2D:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Program Files\Common Files\update.exe
Size 72KB
SHA256 67b19efc793b7ecb5e9f28c275b1f31c4cab286dbffe76d508defaec16c740ce
MD5 4944e1547268cf61618af681633e0a07
SHA1 de22cf7b473d1d7334db087b29b612d9c23c417b
SHA512 59289735c19aebffcbd235249846d64d2aef5da7d154fad04d9402094841f17bdf4883068448c9ffa981b6b8bceb7d2c7bcbfd51dfb12bc5affb99e050acc233
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2O:ypQNwC3BEddsEqOt/hyJF+x3BEJwRri
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
Size 72KB
SHA256 26bd2214f208e6a912e3465dda92511623905780919bffc90ab3ea75abde85a5
MD5 0ae479e23dab68543a4d93cdb1422cfa
SHA1 2ad212281842261cbb10dfe2c2103963bd7980f8
SHA512 1a25b910cb19486d387b99761ecdc554973a49207c2607a24142e7c7bce7117214b8c098fac972b3dd992df440eef42a938bed9470215a18c2097c05dc71944e
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2K:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrFk
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
Size 72KB
SHA256 ce8af0bc42e617b01d88349dd0aca2cbbbde952378a0ddccf25da8a75e803a17
MD5 7228600bffe968e0b50fed4f134bf806
SHA1 2448f9be85259df345f8eee8ff10233b1c72154f
SHA512 1765762859e623068805db3aa723241bf91ffae8e8fda7c85750c811ba323d13f5aec811cc4b483143601e4fa34301d6f47b64e73103e8392250515c0a209720
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2p:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.zip

Path C:\Users\Admin\AppData\Local\Temp\temp.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

temp.zip

Path C:\Users\Admin\AppData\Local\Temp\temp.zip
Size 21KB
SHA256 9698e8abf071094b23e305fa3e5729e452527d1e44915772f5c182e2c7e3fd92
MD5 6a354242e5673f6bd720e8e7681cdd8a
SHA1 d032e89bdb1358691111af7fdf61a2dfe7cd5fc1
SHA512 f3b937959b14eaca5cb6882d3e0a0b176ab1053938aacee7bbdaf79ac12c15e1c4e2267a87fdcc8d57c360f4bf3a630c740745990d82913182c40f2d4bdcf963
SSDEEP 384:BYghe/RauD7MUZ00hOOxZpXLXntW55At9uMTBLSQ/a3AKE:lqLcUZ3QOx3XLXntg6DXhSQOXE
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\{74B0DA1C-AE08-4489-876F-67402BD225FE}\update.exe
Size 72KB
SHA256 29f95610b4052847bd728d53d883b3c43355e10fa4cf329d1762de1ae3b6d657
MD5 a9cc5748a788085371fc5428dfb618cf
SHA1 b9ce480650b33fe50ec68040f8300e61d1fe1f20
SHA512 f02081abf2f4888c4fefbdc618ca1ce8be8533610c8d16649ed8be5bbcc6c58eb538ec9deaac43d215ef6c6f1b45176519252497351e15f6dad0e7d816834c46
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2i:ypQNwC3BEddsEqOt/hyJF+x3BEJwRru
MD5 SHA1 SHA512 SSDEEP

Submit Download

backup.exe

Path C:\backup.exe
Size 72KB
SHA256 f47647f5b6001ce4c8ba6468d1a0bd10be1c494c600eb442ee6917667faee073
MD5 d0f24a2790d018f21ae0f9e4ff260295
SHA1 6e848049150eea6cf1b96151d4776ed7c35973ff
SHA512 a74ce91719315506d9f6531c740ed694235df2691f7cedb56d8cec789b579aa1a6d91681f1ba84b6d78cc0d29349d0d4dadde7a7991ae72ecb3b73b7b43fa351
SSDEEP 384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2u:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1632-3018-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads