71b89b1faf37b920e29f0b0c0836d79ebc2655f3c9f12e87723e9d8059c69f31

Analysis

max time kernel
75s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71b89b1faf37b920e29f0b0c0836d79ebc2655f3c9f12e87723e9d8059c69f31.exe
Size

72KB
MD5

01cffc19eda81650a1e91533513179b8
SHA1

939ed8c84c9892131b3bd1c737721ae9fc25615d
SHA256

71b89b1faf37b920e29f0b0c0836d79ebc2655f3c9f12e87723e9d8059c69f31
SHA512

d49f1a62b2f2a0e87b3b1bc16b886b81bc73c38b4d92f2c95bc174a4dff360a39bb54071bdf24a4d255485da90caca349295132bcd5e0b8373ba35b1ee38bca9
SSDEEP

384:y6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2r:ypQNwC3BEddsEqOt/hyJF+x3BEJwRrH

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\71b89b1faf37b920e29f0b0c0836d79ebc2655f3c9f12e87723e9d8059c69f31.exe
"C:\Users\Admin\AppData\Local\Temp\71b89b1faf37b920e29f0b0c0836d79ebc2655f3c9f12e87723e9d8059c69f31.exe"
1⤵
PID:1956
- C:\Users\Admin\AppData\Local\Temp\609472730\backup.exe
  C:\Users\Admin\AppData\Local\Temp\609472730\backup.exe C:\Users\Admin\AppData\Local\Temp\609472730\
  2⤵
  PID:2064
- - C:\backup.exe
    \backup.exe \
    3⤵
    PID:1884
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\update.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\update.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\
  2⤵
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\System Restore.exe
    "C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\
    3⤵
    PID:2156
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:332

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
1⤵
PID:564

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
1⤵
PID:656
- C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
  2⤵
  PID:1128
- C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
  2⤵
  PID:2924
- C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
  2⤵
  PID:1760
- C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:3028
- C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
  2⤵
  PID:2864
- C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
  2⤵
  PID:2816
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
  2⤵
  PID:2000
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
    3⤵
    PID:2296
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
    3⤵
    PID:1536
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
    3⤵
    PID:2632
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
    3⤵
    PID:2604
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
    3⤵
    PID:2552
- C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
  2⤵
  PID:2836
- C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
  2⤵
  PID:2844
- C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
  2⤵
  PID:2472
- C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:2832
- C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
  2⤵
  PID:1452
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
  2⤵
  PID:2828
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
  2⤵
  PID:2008
- C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
  2⤵
  PID:604
- C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
  2⤵
  PID:1400
- C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
  2⤵
  PID:1632
- C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
  2⤵
  PID:1144
- C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
  2⤵
  PID:2592
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
  2⤵
  PID:1296

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:1716
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:796

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2692

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:2620

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2572
- C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
  2⤵
  PID:2668
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:2640

C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
1⤵
PID:1596

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
1⤵
PID:2156

C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
1⤵
PID:1512

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:1660

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
1⤵
PID:2812

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:1404
- C:\Program Files\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:2896

C:\Program Files\Common Files\System\fr-FR\backup.exe
"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
1⤵
PID:2952

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:1784
- C:\Program Files\Common Files\System\msadc\en-US\backup.exe
  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
  2⤵
  PID:2760
- C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
  2⤵
  PID:2244
- C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
  2⤵
  PID:1724

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2444

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
1⤵
PID:2528

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
1⤵
PID:2176

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:2636

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2488

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:680

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:2944

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
1⤵
PID:2364

C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
1⤵
PID:2504

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
1⤵
PID:1276

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
1⤵
PID:2388

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
1⤵
PID:2932

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
1⤵
PID:960

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\update.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
1⤵
PID:1704

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
1⤵
PID:1760

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
1⤵
PID:996

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:2016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:2236

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:2000

C:\Program Files\Internet Explorer\en-US\backup.exe
"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
1⤵
PID:2832

C:\Program Files\Internet Explorer\es-ES\backup.exe
"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:1468

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:352

C:\Program Files\Java\jdk1.7.0_80\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
1⤵
PID:2264
- C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
  2⤵
  PID:2736

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:692

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:2648

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:840
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
  2⤵
  PID:2596
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
  2⤵
  PID:1288

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
1⤵
PID:1480
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
  2⤵
  PID:1588
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
  2⤵
  PID:900
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
  2⤵
  PID:2664

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
1⤵
PID:2676
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
  2⤵
  PID:2836
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
  2⤵
  PID:2844

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:2488

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
1⤵
PID:2308

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
1⤵
PID:328

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
1⤵
PID:1860

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:2852

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
1⤵
PID:1852

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
1⤵
PID:2484

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
1⤵
PID:2924

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
1⤵
PID:2960

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
1⤵
PID:1484

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
1⤵
PID:3064
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
  2⤵
  PID:936

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
1⤵
PID:2020

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2072

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
1⤵
PID:2524

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2552

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
1⤵
PID:2836

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
1⤵
PID:1564

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:2704

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:1896

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:2400
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
  2⤵
  PID:580

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:604

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:1400

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:1436
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:2776

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
1⤵
PID:2984

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:3032

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:2524

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
1⤵
PID:2540

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:2628

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
1⤵
PID:2440

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:1644

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
1⤵
PID:1348

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:340

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:1456

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
1⤵
PID:2212

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
1⤵
PID:1744

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:600

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2012

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
1⤵
PID:584
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
  2⤵
  PID:988

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
1⤵
PID:2936

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
1⤵
PID:708

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
1⤵
PID:2204

C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
"C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
1⤵
PID:1736

C:\Program Files\Java\jre7\bin\server\backup.exe
"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
1⤵
PID:2452

C:\Program Files\Java\jre7\lib\amd64\update.exe
"C:\Program Files\Java\jre7\lib\amd64\update.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:1960

C:\Program Files\Java\jre7\lib\applet\backup.exe
"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:2828

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:2328

C:\Program Files\Java\jre7\lib\images\backup.exe
"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
1⤵
PID:1560
- C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
  "C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
  2⤵
  PID:2016

C:\Program Files\Java\jre7\lib\jfr\backup.exe
"C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
1⤵
PID:1304

C:\Program Files\Java\jre7\lib\zi\backup.exe
"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
1⤵
PID:2404
- C:\Program Files\Java\jre7\lib\zi\America\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
  2⤵
  PID:780
- - C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
    3⤵
    PID:340
- - C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
    3⤵
    PID:1456
- C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
  2⤵
  PID:2352

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:2916
- C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe
  "C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
  2⤵
  PID:1704

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:1576
- C:\Program Files\Microsoft Games\FreeCell\es-ES\data.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\data.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:2264
- C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
  2⤵
  PID:2756

C:\Program Files\Microsoft Games\Hearts\backup.exe
"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
1⤵
PID:2632
- C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
  2⤵
  PID:1528
- C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
  2⤵
  PID:1556

C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
1⤵
PID:2292

C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
1⤵
PID:1684

C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
1⤵
PID:2332

C:\Program Files\Microsoft Games\Mahjong\ja-JP\data.exe
"C:\Program Files\Microsoft Games\Mahjong\ja-JP\data.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
1⤵
PID:1348

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:340

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
1⤵
PID:1200

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:2352

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
1⤵
PID:1540

C:\Program Files\Microsoft Games\Multiplayer\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
1⤵
PID:3000

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:988

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
1⤵
PID:916

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
1⤵
PID:1668

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
1⤵
PID:2984

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:2692

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
1⤵
PID:2640

C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
1⤵
PID:2632

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
1⤵
PID:1016

C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
1⤵
PID:1628

C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
1⤵
PID:776

C:\Program Files\Microsoft Games\Solitaire\es-ES\System Restore.exe
"C:\Program Files\Microsoft Games\Solitaire\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
1⤵
PID:1520

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
1⤵
PID:1488

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
1⤵
PID:488

C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
1⤵
PID:848

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\update.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\update.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
1⤵
PID:2348

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
1⤵
PID:348

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2364
- C:\Program Files\Microsoft Office\Office14\1033\backup.exe
  "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
  2⤵
  PID:2944

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:584
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:2232
- C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:1688

C:\Program Files\Mozilla Firefox\browser\features\backup.exe
"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
1⤵
PID:840

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:576

C:\Program Files\MSBuild\Microsoft\backup.exe
"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
1⤵
PID:2612

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:1960
- C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
  2⤵
  PID:2828
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:332
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
      4⤵
      PID:1468
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
      4⤵
      PID:1636
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
      4⤵
      PID:2340

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:1524

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:1956

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:1112

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:2208

C:\Program Files\VideoLAN\VLC\hrtfs\update.exe
"C:\Program Files\VideoLAN\VLC\hrtfs\update.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
1⤵
PID:2008

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
1⤵
PID:1916
- C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
  2⤵
  PID:1268

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
1⤵
PID:2200

C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
1⤵
PID:956

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:2936

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
1⤵
PID:996

C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
1⤵
PID:2692
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
  2⤵
  PID:1740

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
1⤵
PID:2604

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:2236

C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
1⤵
PID:2704
- C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
  2⤵
  PID:1728

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:1516

C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
1⤵
PID:1652

C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
1⤵
PID:2028

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:1196

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:2944

C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
1⤵
PID:960

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
1⤵
PID:916

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
1⤵
PID:2220

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
1⤵
PID:1676

C:\Program Files\VideoLAN\VLC\locale\fi\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
1⤵
PID:2184

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:1048

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
1⤵
PID:2912

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
1⤵
PID:1856

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
1⤵
PID:2340

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
1⤵
PID:332

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:404

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
1⤵
PID:2776

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
1⤵
PID:1988

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
1⤵
PID:2836

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:2356

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:1628

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
1⤵
PID:2332

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:1960

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
1⤵
PID:3004

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
1⤵
PID:3036
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
  2⤵
  PID:796

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:1508

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:2716

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:2156

C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
1⤵
PID:776

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
1⤵
PID:1960

C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
1⤵
PID:1692

C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
1⤵
PID:2008

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:488

C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
1⤵
PID:2916

C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
1⤵
PID:1716

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
1⤵
PID:1528

C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
1⤵
PID:1684
- C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
  2⤵
  PID:2428

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
1⤵
PID:2752

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
1⤵
PID:1116

C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
1⤵
PID:2352

C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
1⤵
PID:2828
- C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
  2⤵
  PID:2168

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
1⤵
PID:548

C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
1⤵
PID:960

C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
1⤵
PID:304
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
  2⤵
  PID:2916

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
1⤵
PID:1924

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:884

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
1⤵
PID:2716

C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
1⤵
PID:2116

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
1⤵
PID:2292

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:2236

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:1644

C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
1⤵
PID:2176

C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
1⤵
PID:2516

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
1⤵
PID:1468

C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
1⤵
PID:1488

C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
1⤵
PID:2956

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
1⤵
PID:1076

C:\Program Files\VideoLAN\VLC\locale\te\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\te\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\te\
1⤵
PID:2592

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
1⤵
PID:2924

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
1⤵
PID:652

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
1⤵
PID:2624
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
  2⤵
  PID:1740
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
  2⤵
  PID:2456
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
  2⤵
  PID:2212
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
  2⤵
  PID:1540
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
  2⤵
  PID:1452
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
  2⤵
  PID:1632

C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
1⤵
PID:1716
- C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
  2⤵
  PID:632

C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
1⤵
PID:2760

C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
1⤵
PID:2756
- C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
  2⤵
  PID:1548

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:356

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:2332

C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\
1⤵
PID:1196

C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
1⤵
PID:880

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:988
- C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
  2⤵
  PID:1248
- - C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
    3⤵
    PID:2040
  - - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
      4⤵
      PID:2808
    - - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
        5⤵
        
        PID:1532
- - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
    3⤵
    PID:2540
- - C:\Program Files\VideoLAN\VLC\lua\http\requests\update.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\requests\update.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
    3⤵
    PID:1668
- C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
  2⤵
  PID:332
- C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
  2⤵
  PID:2752

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
1⤵
PID:1736
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
  2⤵
  PID:580

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
1⤵
PID:2240

C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
1⤵
PID:2392

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
1⤵
PID:2552
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
  2⤵
  PID:692

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:2704

C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
1⤵
PID:2956

C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
1⤵
PID:452

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:572
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
  2⤵
  PID:1752
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
  2⤵
  PID:2952
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
  2⤵
  PID:1576
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
  2⤵
  PID:1876
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
  2⤵
  PID:2136
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
  2⤵
  PID:112
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
  2⤵
  PID:1700
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
  2⤵
  PID:2748
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
  2⤵
  PID:304
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
  2⤵
  PID:2356
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
  2⤵
  PID:2688
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
  2⤵
  PID:548

C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
1⤵
PID:1616

C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
1⤵
PID:2920

C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
1⤵
PID:1968

C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
1⤵
PID:3016

C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\meta_engine\
1⤵
PID:1864

C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\services_discovery\
1⤵
PID:1856

C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\text_renderer\
1⤵
PID:2660

C:\Program Files\VideoLAN\VLC\plugins\video_filter\System Restore.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_filter\System Restore.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
1⤵
PID:3048

C:\Program Files\VideoLAN\VLC\skins\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
1⤵
PID:1460
- C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
  2⤵
  PID:2920

C:\Program Files\Windows Defender\de-DE\backup.exe
"C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
1⤵
PID:2276

C:\Program Files\Windows Defender\en-US\System Restore.exe
"C:\Program Files\Windows Defender\en-US\System Restore.exe" C:\Program Files\Windows Defender\en-US\
1⤵
PID:1532

C:\Program Files\Windows Journal\fr-FR\backup.exe
"C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
1⤵
PID:2704

C:\Program Files\Windows Journal\Templates\backup.exe
"C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
1⤵
PID:1420

C:\Program Files\Windows Mail\de-DE\backup.exe
"C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
1⤵
PID:2388

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:2020

C:\Program Files\Windows Media Player\fr-FR\backup.exe
"C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:2904

C:\Program Files\Windows Media Player\ja-JP\update.exe
"C:\Program Files\Windows Media Player\ja-JP\update.exe" C:\Program Files\Windows Media Player\ja-JP\
1⤵
PID:2908

C:\Program Files\Windows Media Player\Network Sharing\backup.exe
"C:\Program Files\Windows Media Player\Network Sharing\backup.exe" C:\Program Files\Windows Media Player\Network Sharing\
1⤵
PID:2180

C:\Program Files\Windows Media Player\Visualizations\backup.exe
"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\
1⤵
PID:280

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:1348
- C:\Program Files\Windows NT\Accessories\backup.exe
  "C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
  2⤵
  PID:2456
- - C:\Program Files\Windows NT\Accessories\en-US\backup.exe
    "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
    3⤵
    PID:2852
- - C:\Program Files\Windows NT\Accessories\ja-JP\backup.exe
    "C:\Program Files\Windows NT\Accessories\ja-JP\backup.exe" C:\Program Files\Windows NT\Accessories\ja-JP\
    3⤵
    PID:1704

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
1⤵
PID:340

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\
1⤵
PID:1200

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\
1⤵
PID:2844

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
1⤵
PID:452

C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe
"C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files\Windows NT\TableTextService\de-DE\
1⤵
PID:1208

C:\Program Files\Windows NT\TableTextService\es-ES\backup.exe
"C:\Program Files\Windows NT\TableTextService\es-ES\backup.exe" C:\Program Files\Windows NT\TableTextService\es-ES\
1⤵
PID:2012

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
1⤵
PID:2624

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:2180

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
1⤵
PID:1980

C:\Program Files\Windows Sidebar\fr-FR\data.exe
"C:\Program Files\Windows Sidebar\fr-FR\data.exe" C:\Program Files\Windows Sidebar\fr-FR\
1⤵
PID:1860

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
1⤵
PID:1916
- C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\
  2⤵
  PID:2844
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\
    3⤵
    PID:1540

C:\Program Files\Windows Sidebar\Gadgets\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\
1⤵
PID:1552
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\
  2⤵
  PID:1236
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
    3⤵
    PID:548
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\
    3⤵
    PID:2668
  - - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
      4⤵
      PID:1416
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\
    3⤵
    PID:2452
  - - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
      4⤵
      PID:2540
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
    3⤵
    PID:3016
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\
  2⤵
  PID:1644
- - C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\
    3⤵
    PID:2812
- - C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\
    3⤵
    PID:412
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\
  2⤵
  PID:2328
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
    3⤵
    PID:2152
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\
    3⤵
    PID:2000
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
    3⤵
    PID:1624
  - - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\System Restore.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\
      4⤵
      PID:2404
  - - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\
      4⤵
      PID:2200
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
    3⤵
    PID:1436
  - - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\
      4⤵
      PID:1616
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\
    3⤵
    PID:1296
  - - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\update.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\update.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
      4⤵
      PID:1508
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\
  2⤵
  PID:2888
- - C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\
    3⤵
    PID:1908
- - C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\
    3⤵
    PID:2428

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
1⤵
PID:2868

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\
1⤵
PID:2624

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
1⤵
PID:1868

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\
1⤵
PID:1852

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\
1⤵
PID:1808

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\
1⤵
PID:2368

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
1⤵
PID:2952

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:2020

C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe
"C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\
1⤵
PID:2412

C:\Program Files (x86)\Common Files\System\Ole DB\update.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\update.exe" C:\Program Files (x86)\Common Files\System\Ole DB\
1⤵
PID:1012
- C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\
  2⤵
  PID:2176
- C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
  2⤵
  PID:1112
- C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:1192

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
1⤵
PID:384

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\
1⤵
PID:2008

C:\Program Files (x86)\Google\Temp\backup.exe
"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
1⤵
PID:452

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
1⤵
PID:600

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
1⤵
PID:2272

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\
1⤵
PID:1924

C:\Program Files (x86)\Google\Update\Offline\backup.exe
"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
1⤵
PID:2460

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
1⤵
PID:1580

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
1⤵
PID:1600

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
1⤵
PID:2184

C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
1⤵
PID:2136
- C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
  2⤵
  PID:1028

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
1⤵
PID:960

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
1⤵
PID:348

C:\Program Files (x86)\Microsoft Office\Document Themes 14\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\
1⤵
PID:1868

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\data.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\
1⤵
PID:1520

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\data.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\data.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\
1⤵
PID:824

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\
1⤵
PID:2056
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\data.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
  2⤵
  PID:2088

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\data.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\data.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
1⤵
PID:1200

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\
1⤵
PID:900
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\
  2⤵
  PID:1716
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\
    3⤵
    PID:1400
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\update.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
    3⤵
    PID:2384

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
1⤵
PID:908

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\
1⤵
PID:1568

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
1⤵
PID:796

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\
1⤵
PID:2236

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
1⤵
PID:2912
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\
  2⤵
  PID:2836

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:2688

C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\
1⤵
PID:2764

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\
1⤵
PID:2848

C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\
1⤵
PID:2692

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\
1⤵
PID:2932

C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\3082\
1⤵
PID:2116

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\
1⤵
PID:2944

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
1⤵
PID:2436

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
1⤵
PID:3048

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\
1⤵
PID:2608

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\
1⤵
PID:1016

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
1⤵
PID:1636

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\
1⤵
PID:2316

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\
1⤵
PID:2144

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:332
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
  2⤵
  PID:656

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:1744

C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\
1⤵
PID:2896
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\
  2⤵
  PID:2096

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\
1⤵
PID:1408

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\
1⤵
PID:2368
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
  2⤵
  PID:2980

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\
1⤵
PID:2304

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\
1⤵
PID:1576

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\
1⤵
PID:2540

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\
1⤵
PID:2016

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
1⤵
PID:2236

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\
1⤵
PID:352

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\
1⤵
PID:1304

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\
1⤵
PID:2120

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\
1⤵
PID:2940
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\data.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\
  2⤵
  PID:2432

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
1⤵
PID:1592

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\
1⤵
PID:2160
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\update.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
  2⤵
  PID:1116
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\
  2⤵
  PID:1712

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\
1⤵
PID:788

C:\Program Files\Windows Sidebar\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\ja-JP\
1⤵
PID:2304

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\
1⤵
PID:2796
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\
  2⤵
  PID:2464

C:\Users\Admin\backup.exe
C:\Users\Admin\backup.exe C:\Users\Admin\
1⤵
PID:1684
- C:\Users\Admin\Contacts\System Restore.exe
  "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
  2⤵
  PID:2828
- C:\Users\Admin\Desktop\backup.exe
  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
  2⤵
  PID:1420
- C:\Users\Admin\Music\backup.exe
  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
  2⤵
  PID:488
- C:\Users\Admin\Pictures\backup.exe
  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
  2⤵
  PID:2552

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\
1⤵
PID:1260
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\
  2⤵
  PID:1908

C:\Users\Public\Documents\backup.exe
C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
1⤵
PID:920

C:\Users\Public\Downloads\backup.exe
C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
1⤵
PID:2444

C:\Users\Public\Music\Sample Music\backup.exe
"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
1⤵
PID:2508

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:2624

C:\Users\Public\Recorded TV\Sample Media\backup.exe
"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\
1⤵
PID:1948

C:\Users\Public\Videos\backup.exe
C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
1⤵
PID:3032
- C:\Users\Public\Videos\Sample Videos\backup.exe
  "C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
  2⤵
  PID:3048

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\
1⤵
PID:1688

C:\Windows\addins\backup.exe
C:\Windows\addins\backup.exe C:\Windows\addins\
1⤵
PID:1984

C:\Windows\AppPatch\AppPatch64\backup.exe
C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
1⤵
PID:2308

C:\Windows\AppPatch\Custom\Custom64\backup.exe
C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\
1⤵
PID:1276

C:\Windows\AppPatch\de-DE\backup.exe
C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
1⤵
PID:1448

C:\Windows\AppPatch\es-ES\backup.exe
C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\
1⤵
PID:1620

C:\Windows\AppPatch\it-IT\backup.exe
C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\
1⤵
PID:2040

C:\Windows\assembly\GAC\ADODB\backup.exe
C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
1⤵
PID:1348

C:\Program Files (x86)\Microsoft Office\Office14\OneNote\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\OneNote\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\OneNote\
1⤵
PID:1048

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\
1⤵
PID:2428
- C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\
  2⤵
  PID:1504

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:1708

C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\
1⤵
PID:1076

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2824

C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe
"C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\
1⤵
PID:1960

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1544

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
1⤵
PID:2848
- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1736

C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\
1⤵
PID:1652
- C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\
  2⤵
  PID:2692

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:1880

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
1⤵
PID:628

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\
1⤵
PID:1636
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2088
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2008

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
1⤵
PID:1012

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\
1⤵
PID:1320

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:2972
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:900

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:1484
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:112
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\
    3⤵
    PID:1616
  - - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe
      "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\
      4⤵
      PID:1916
    - - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\backup.exe
        
        "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\
        5⤵
        
        PID:1692

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
1⤵
PID:2872
- C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2604

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\
1⤵
PID:2192
- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2876

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\
1⤵
PID:2304
- C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2916

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\
1⤵
PID:2712

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\
1⤵
PID:996
- C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2328

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\
1⤵
PID:1532

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\
1⤵
PID:2300
- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2636

C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe
"C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\
1⤵
PID:240

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2796

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\
1⤵
PID:2512

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\
1⤵
PID:2660

C:\Windows\assembly\GAC_32\MSBuild\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:2484

C:\Windows\assembly\GAC_32\naphlpr\backup.exe
C:\Windows\assembly\GAC_32\naphlpr\backup.exe C:\Windows\assembly\GAC_32\naphlpr\
1⤵
PID:2652
- C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1736

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\
1⤵
PID:2520

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1980

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:2128

C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\data.exe
C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\data.exe C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\
1⤵
PID:936

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2428

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:884

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:2372

C:\Windows\assembly\GAC_32\System.Data\backup.exe
C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:2588
- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2992

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:2364

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
1⤵
PID:960

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:2648

C:\Program Files (x86)\Reference Assemblies\backup.exe
"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:1620

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\
1⤵
PID:1516
- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1544

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
1⤵
PID:1216
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\
  2⤵
  PID:2324
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
    3⤵
    PID:2524

C:\Windows\assembly\GAC_32\System.Printing\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\backup.exe C:\Windows\assembly\GAC_32\System.Printing\
1⤵
PID:2564
- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1200

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
1⤵
PID:2876

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2628

C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:2292

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
1⤵
PID:2020

C:\Windows\assembly\GAC_64\CustomMarshalers\System Restore.exe
"C:\Windows\assembly\GAC_64\CustomMarshalers\System Restore.exe" C:\Windows\assembly\GAC_64\CustomMarshalers\
1⤵
PID:1864

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2464

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:1876

C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1652

C:\Program Files (x86)\Windows Mail\data.exe
"C:\Program Files (x86)\Windows Mail\data.exe" C:\Program Files (x86)\Windows Mail\
1⤵
PID:868
- C:\Program Files (x86)\Windows Mail\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Mail\es-ES\backup.exe" C:\Program Files (x86)\Windows Mail\es-ES\
  2⤵
  PID:2820

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
1⤵
PID:1644

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2608

C:\Program Files (x86)\Windows Media Player\backup.exe
"C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\
1⤵
PID:1612
- C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
  2⤵
  PID:2404
- C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
  2⤵
  PID:1712

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\
1⤵
PID:2432
- C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:352

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1808

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\data.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\data.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\
1⤵
PID:644

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\
1⤵
PID:1192

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1912

C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\de-DE\
1⤵
PID:2424

C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\es-ES\
1⤵
PID:2400

C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\
1⤵
PID:1804
- C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2620

C:\Program Files (x86)\Windows NT\TableTextService\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:1248
- C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
  2⤵
  PID:1860
- C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\
  2⤵
  PID:2088

C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1128

C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2388

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:404

C:\Program Files (x86)\Windows Photo Viewer\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\
1⤵
PID:2384
- C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe
  "C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\en-US\
  2⤵
  PID:540

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2552

C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1200

C:\Windows\assembly\GAC_64\System.Data\backup.exe
C:\Windows\assembly\GAC_64\System.Data\backup.exe C:\Windows\assembly\GAC_64\System.Data\
1⤵
PID:2544

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\
1⤵
PID:2848

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\
1⤵
PID:2212
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
  2⤵
  PID:2656
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
    3⤵
    PID:2296
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\
  2⤵
  PID:2364
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\
  2⤵
  PID:1196
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\
    3⤵
    PID:788
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
    3⤵
    PID:2600

C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1984

C:\Windows\assembly\GAC_MSIL\backup.exe
C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\
1⤵
PID:1848
- C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
  C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
  2⤵
  PID:2940
- - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:356
- C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiActivScp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\
  2⤵
  PID:2440
- C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\
  2⤵
  PID:2480
- - C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2848
- C:\Windows\assembly\GAC_MSIL\ehiProxy\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiProxy\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\
  2⤵
  PID:2828
- - C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2668
- C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\
  2⤵
  PID:2992
- C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\
  2⤵
  PID:1516
- - C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:956
- C:\Windows\assembly\GAC_MSIL\EventViewer\backup.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer\
  2⤵
  PID:1668
- C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe
  C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\
  2⤵
  PID:692
- - C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1792
- C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe
  C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\
  2⤵
  PID:1724
- - C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\System Restore.exe
    "C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:1708
- C:\Windows\assembly\GAC_MSIL\mcstore\backup.exe
  C:\Windows\assembly\GAC_MSIL\mcstore\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\
  2⤵
  PID:1508
- - C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\data.exe
    C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:1268
- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\
  2⤵
  PID:2292
- - C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\
    3⤵
    PID:2560
- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\
  2⤵
  PID:1304
- - C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
    3⤵
    PID:2788
- - C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
    3⤵
    PID:1808
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\
  2⤵
  PID:2972
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1552
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\data.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\
  2⤵
  PID:1736
- C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\
  2⤵
  PID:1192
- - C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\
    3⤵
    PID:452
- C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\
  2⤵
  PID:1908
- - C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:1784
- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting\
  2⤵
  PID:304
- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\
  2⤵
  PID:2076
- - C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\
    3⤵
    PID:1868
- - C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_it_31bf3856ad364e35\
    3⤵
    PID:2432
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
  2⤵
  PID:1488
- - C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\System Restore.exe
    "C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
    3⤵
    PID:2472
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\
  2⤵
  PID:708
- - C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:840
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\
  2⤵
  PID:1004
- - C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:1532
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\
  2⤵
  PID:1260
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\
  2⤵
  PID:2012
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\
  2⤵
  PID:632
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2304
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\
  2⤵
  PID:1028
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\
  2⤵
  PID:1880
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\
  2⤵
  PID:1456
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\
  2⤵
  PID:2652
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2452
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\
  2⤵
  PID:1980
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:1352
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\
  2⤵
  PID:1660
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:936
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\
  2⤵
  PID:1624
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\
  2⤵
  PID:1128
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\
  2⤵
  PID:1608
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\
  2⤵
  PID:1808
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\
  2⤵
  PID:1112
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2340
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\
  2⤵
  PID:2392
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2308
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\
  2⤵
  PID:2556
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:548
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\
  2⤵
  PID:2580
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\data.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2484
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\
  2⤵
  PID:1196
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
  2⤵
  PID:300
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:1588
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\
  2⤵
  PID:956
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:2528
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\
  2⤵
  PID:1416
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2732
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\
  2⤵
  PID:2300
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
  2⤵
  PID:2016
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1796
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\
  2⤵
  PID:2692
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2648
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\
  2⤵
  PID:2812
- - C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\
    3⤵
    PID:2120
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\
  2⤵
  PID:2292
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\
  2⤵
  PID:1144
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\
  2⤵
  PID:2920
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\
  2⤵
  PID:2852
- - C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\
    3⤵
    PID:1016
- - C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\data.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\
    3⤵
    PID:1448
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\
  2⤵
  PID:2664
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\
  2⤵
  PID:1260
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\
  2⤵
  PID:2884
- C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\
  2⤵
  PID:2712
- C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\
  2⤵
  PID:2952
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\
  2⤵
  PID:1128
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\
  2⤵
  PID:1608
- - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2160
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\
  2⤵
  PID:1680
- - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1744
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\
  2⤵
  PID:452
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\
  2⤵
  PID:1348
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\
  2⤵
  PID:300
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\
  2⤵
  PID:240
- - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1624
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\
  2⤵
  PID:2296
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\
  2⤵
  PID:1680
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\
  2⤵
  PID:2480
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\
  2⤵
  PID:2464
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\
  2⤵
  PID:1144
- - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe
    "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2172
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\
  2⤵
  PID:2008
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\
  2⤵
  PID:332
- C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\
  2⤵
  PID:2088
- - C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1304
- C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\
  2⤵
  PID:1004
- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\mscorlib.resources\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\
  2⤵
  PID:3016
- - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe
    C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\
    3⤵
    PID:1728
- C:\Windows\assembly\GAC_MSIL\napinit.resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\napinit.resources\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\
  2⤵
  PID:2620
- - C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\
    3⤵
    PID:2016
- C:\Windows\assembly\GAC_MSIL\Narrator\backup.exe
  C:\Windows\assembly\GAC_MSIL\Narrator\backup.exe C:\Windows\assembly\GAC_MSIL\Narrator\
  2⤵
  PID:2168
- C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\
  2⤵
  PID:1688

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
1⤵
PID:2992

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2944

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1660

C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2024

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:584

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\
1⤵
PID:2572
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\
  2⤵
  PID:1404
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
    3⤵
    PID:2552
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\
  2⤵
  PID:596
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
  2⤵
  PID:2472
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
    3⤵
    PID:576

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\
1⤵
PID:792

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\
1⤵
PID:1200

C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:324

C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2384

C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2368

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
1⤵
PID:584

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:2316

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2336

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:2584

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2840

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\
1⤵
PID:2088

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2156

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
1⤵
PID:1076

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:280
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\
  2⤵
  PID:1544

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\
1⤵
PID:1752
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\
  2⤵
  PID:1880

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\
1⤵
PID:2680

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
1⤵
PID:1984
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
  2⤵
  PID:628

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1636

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\
1⤵
PID:2028
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
  2⤵
  PID:2768

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:780

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:644

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\
1⤵
PID:884

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2944

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:1516

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
1⤵
PID:1612

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:324

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:304

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2236

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\
1⤵
PID:1000

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:1580

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\
1⤵
PID:1708

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
1⤵
PID:680

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:1852
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
  2⤵
  PID:2116

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:1612

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
1⤵
PID:1784

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
1⤵
PID:1724

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3040

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\
1⤵
PID:1864

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2752

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1400

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:1420

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:2044

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3004

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:2880

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
1⤵
PID:1692

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2328

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:2236

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\
1⤵
PID:2560

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\
1⤵
PID:2468

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:1512

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\
1⤵
PID:2456

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:1516

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2520

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:1260

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:2292

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1000

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
1⤵
PID:1984

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\
1⤵
PID:1436

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
1⤵
PID:2660

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\
1⤵
PID:880

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1516

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\
1⤵
PID:1560

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
1⤵
PID:2608

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:2352

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2420

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\
1⤵
PID:996

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1860

C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\it-IT\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1988

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1480

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:332

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2760

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1792

C:\Windows\Branding\System Restore.exe
"C:\Windows\Branding\System Restore.exe" C:\Windows\Branding\
1⤵
PID:2204

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1652

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1368

C:\Windows\Branding\Basebrd\it-IT\backup.exe
C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
1⤵
PID:2356

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\
1⤵
PID:348

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1532

C:\Windows\debug\WIA\backup.exe
C:\Windows\debug\WIA\backup.exe C:\Windows\debug\WIA\
1⤵
PID:868

C:\Windows\DigitalLocker\en-US\backup.exe
C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
1⤵
PID:2840

C:\Windows\DigitalLocker\es-ES\backup.exe
C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
1⤵
PID:1508

C:\Windows\DigitalLocker\it-IT\backup.exe
C:\Windows\DigitalLocker\it-IT\backup.exe C:\Windows\DigitalLocker\it-IT\
1⤵
PID:2380

C:\Windows\ehome\CreateDisc\Filters\backup.exe
C:\Windows\ehome\CreateDisc\Filters\backup.exe C:\Windows\ehome\CreateDisc\Filters\
1⤵
PID:2604

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1296

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2368

C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\
1⤵
PID:2784

C:\Windows\ehome\MCX\X02\backup.exe
C:\Windows\ehome\MCX\X02\backup.exe C:\Windows\ehome\MCX\X02\
1⤵
PID:1988

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1304

C:\Windows\ehome\wow\de-DE\backup.exe
C:\Windows\ehome\wow\de-DE\backup.exe C:\Windows\ehome\wow\de-DE\
1⤵
PID:880

C:\Windows\ehome\wow\fr-FR\backup.exe
C:\Windows\ehome\wow\fr-FR\backup.exe C:\Windows\ehome\wow\fr-FR\
1⤵
PID:796

C:\Windows\ehome\wow\ja-JP\backup.exe
C:\Windows\ehome\wow\ja-JP\backup.exe C:\Windows\ehome\wow\ja-JP\
1⤵
PID:2728

C:\Windows\Globalization\backup.exe
C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
1⤵
PID:1000
- C:\Windows\Globalization\Sorting\backup.exe
  C:\Windows\Globalization\Sorting\backup.exe C:\Windows\Globalization\Sorting\
  2⤵
  PID:1628

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2668

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2504

C:\Windows\Help\Help\backup.exe
C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
1⤵
PID:2704

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2312

C:\Windows\Help\mui\0410\backup.exe
C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\
1⤵
PID:1352

C:\Windows\Help\Windows\System Restore.exe
"C:\Windows\Help\Windows\System Restore.exe" C:\Windows\Help\Windows\
1⤵
PID:2616
- C:\Windows\Help\Windows\fr-FR\backup.exe
  C:\Windows\Help\Windows\fr-FR\backup.exe C:\Windows\Help\Windows\fr-FR\
  2⤵
  PID:1708

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2192

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1864

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2852

C:\Windows\IME\IMEJP10\backup.exe
C:\Windows\IME\IMEJP10\backup.exe C:\Windows\IME\IMEJP10\
1⤵
PID:632
- C:\Windows\IME\IMEJP10\help\backup.exe
  C:\Windows\IME\IMEJP10\help\backup.exe C:\Windows\IME\IMEJP10\help\
  2⤵
  PID:2332

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\
1⤵
PID:2528

C:\Windows\IME\imekr8\dicts\backup.exe
C:\Windows\IME\imekr8\dicts\backup.exe C:\Windows\IME\imekr8\dicts\
1⤵
PID:2356

C:\Windows\IME\ja-JP\backup.exe
C:\Windows\IME\ja-JP\backup.exe C:\Windows\IME\ja-JP\
1⤵
PID:2152

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2796

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2432

C:\Windows\inf\ASP.NET\backup.exe
C:\Windows\inf\ASP.NET\backup.exe C:\Windows\inf\ASP.NET\
1⤵
PID:1400
- C:\Windows\inf\ASP.NET\0001\update.exe
  C:\Windows\inf\ASP.NET\0001\update.exe C:\Windows\inf\ASP.NET\0001\
  2⤵
  PID:1452
- C:\Windows\inf\ASP.NET\0009\backup.exe
  C:\Windows\inf\ASP.NET\0009\backup.exe C:\Windows\inf\ASP.NET\0009\
  2⤵
  PID:2552
- C:\Windows\inf\ASP.NET\0010\backup.exe
  C:\Windows\inf\ASP.NET\0010\backup.exe C:\Windows\inf\ASP.NET\0010\
  2⤵
  PID:2820
- C:\Windows\inf\ASP.NET\0012\backup.exe
  C:\Windows\inf\ASP.NET\0012\backup.exe C:\Windows\inf\ASP.NET\0012\
  2⤵
  PID:240

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2088

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:840

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2196

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2044

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1752

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2652

C:\Windows\inf\ASP.NET_4.0.30319\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\
1⤵
PID:2076
- C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0006\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0006\
  2⤵
  PID:2604
- C:\Windows\inf\ASP.NET_4.0.30319\0009\data.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0009\data.exe C:\Windows\inf\ASP.NET_4.0.30319\0009\
  2⤵
  PID:2632
- C:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0011\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0011\
  2⤵
  PID:2620
- C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0012\
  2⤵
  PID:2212
- C:\Windows\inf\ASP.NET_4.0.30319\0013\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0013\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0013\
  2⤵
  PID:1368
- C:\Windows\inf\ASP.NET_4.0.30319\0019\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\0019\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0019\
  2⤵
  PID:2992
- C:\Windows\inf\ASP.NET_4.0.30319\001D\backup.exe
  C:\Windows\inf\ASP.NET_4.0.30319\001D\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\001D\
  2⤵
  PID:2428

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2356

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2368

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2016

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2608

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2168

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1540

C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\
1⤵
PID:548

C:\Windows\inf\aspnet_state\0000\backup.exe
C:\Windows\inf\aspnet_state\0000\backup.exe C:\Windows\inf\aspnet_state\0000\
1⤵
PID:2724

C:\Windows\inf\aspnet_state\0005\backup.exe
C:\Windows\inf\aspnet_state\0005\backup.exe C:\Windows\inf\aspnet_state\0005\
1⤵
PID:2544

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:292

C:\Windows\inf\aspnet_state\0007\backup.exe
C:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\
1⤵
PID:1740

C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\
1⤵
PID:2572

C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\
1⤵
PID:2796
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\
  2⤵
  PID:1708

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1584

C:\Windows\inf\aspnet_state\000C\backup.exe
C:\Windows\inf\aspnet_state\000C\backup.exe C:\Windows\inf\aspnet_state\000C\
1⤵
PID:2656

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:384

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\
1⤵
PID:2088
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\
  2⤵
  PID:2596

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\
1⤵
PID:2492

C:\Windows\inf\aspnet_state\0014\backup.exe
C:\Windows\inf\aspnet_state\0014\backup.exe C:\Windows\inf\aspnet_state\0014\
1⤵
PID:2448

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2600

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\
1⤵
PID:2820

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\
1⤵
PID:304

C:\Windows\inf\aspnet_state\0019\backup.exe
C:\Windows\inf\aspnet_state\0019\backup.exe C:\Windows\inf\aspnet_state\0019\
1⤵
PID:808

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\
1⤵
PID:2432

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\
1⤵
PID:1708

C:\Windows\inf\aspnet_state\0416\backup.exe
C:\Windows\inf\aspnet_state\0416\backup.exe C:\Windows\inf\aspnet_state\0416\
1⤵
PID:1744

C:\Windows\inf\aspnet_state\0816\backup.exe
C:\Windows\inf\aspnet_state\0816\backup.exe C:\Windows\inf\aspnet_state\0816\
1⤵
PID:1408

C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\654c5baca16d72756296ab1d927ea4a8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\654c5baca16d72756296ab1d927ea4a8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\654c5baca16d72756296ab1d927ea4a8\
1⤵
PID:1712

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2920

C:\Windows\inf\BITS\backup.exe
C:\Windows\inf\BITS\backup.exe C:\Windows\inf\BITS\
1⤵
PID:1588
- C:\Windows\inf\BITS\0C0A\backup.exe
  C:\Windows\inf\BITS\0C0A\backup.exe C:\Windows\inf\BITS\0C0A\
  2⤵
  PID:3040

C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\
1⤵
PID:2908

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\
1⤵
PID:2332

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:628

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\
1⤵
PID:2476

C:\Windows\inf\de-DE\backup.exe
C:\Windows\inf\de-DE\backup.exe C:\Windows\inf\de-DE\
1⤵
PID:2560

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\
1⤵
PID:1248

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\
1⤵
PID:3012
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\
  2⤵
  PID:2012

C:\Windows\inf\ESENT\0411\backup.exe
C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
1⤵
PID:888

C:\Windows\inf\ESENT\0C0A\backup.exe
C:\Windows\inf\ESENT\0C0A\backup.exe C:\Windows\inf\ESENT\0C0A\
1⤵
PID:2916

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\
1⤵
PID:1804

C:\Windows\inf\ja-JP\backup.exe
C:\Windows\inf\ja-JP\backup.exe C:\Windows\inf\ja-JP\
1⤵
PID:2676

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\
1⤵
PID:2208

C:\Windows\inf\MSDTC\040C\backup.exe
C:\Windows\inf\MSDTC\040C\backup.exe C:\Windows\inf\MSDTC\040C\
1⤵
PID:2516

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\
1⤵
PID:1512

C:\Windows\inf\MSDTC\0411\backup.exe
C:\Windows\inf\MSDTC\0411\backup.exe C:\Windows\inf\MSDTC\0411\
1⤵
PID:2056

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0000\
1⤵
PID:848

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\
1⤵
PID:1760

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\
1⤵
PID:2968

C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2676

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\630257a0b042768c2e3104a36559c1a9\
1⤵
PID:1556

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\update.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\update.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\
1⤵
PID:2784

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\
1⤵
PID:780

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2848

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2864

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\
1⤵
PID:2200

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\
1⤵
PID:1684

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\
1⤵
PID:1700

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2564

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\
1⤵
PID:2588

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
1⤵
PID:2816

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0010\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0010\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0010\
1⤵
PID:628

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\
1⤵
PID:2240

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\
1⤵
PID:1856

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:3048

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0015\
1⤵
PID:1536

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:488

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\
1⤵
PID:2604

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2304

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2316

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e998eeb1548ffd53b39dcde50d196ab7\
1⤵
PID:584

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2640

C:\Windows\inf\PERFLIB\0407\backup.exe
C:\Windows\inf\PERFLIB\0407\backup.exe C:\Windows\inf\PERFLIB\0407\
1⤵
PID:2576

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\
1⤵
PID:1852

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2476

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2872

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\
1⤵
PID:1704

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1408

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\
1⤵
PID:920

C:\Windows\inf\PNRPSvc\0409\backup.exe
C:\Windows\inf\PNRPSvc\0409\backup.exe C:\Windows\inf\PNRPSvc\0409\
1⤵
PID:1684

C:\Windows\inf\PNRPSvc\0411\update.exe
C:\Windows\inf\PNRPSvc\0411\update.exe C:\Windows\inf\PNRPSvc\0411\
1⤵
PID:1912

C:\Windows\inf\rdyboost\backup.exe
C:\Windows\inf\rdyboost\backup.exe C:\Windows\inf\rdyboost\
1⤵
PID:2116
- C:\Windows\inf\rdyboost\0000\backup.exe
  C:\Windows\inf\rdyboost\0000\backup.exe C:\Windows\inf\rdyboost\0000\
  2⤵
  PID:1748

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2192

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1320

C:\Windows\inf\RemoteAccess\0000\backup.exe
C:\Windows\inf\RemoteAccess\0000\backup.exe C:\Windows\inf\RemoteAccess\0000\
1⤵
PID:2444

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\
1⤵
PID:1956

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:3016

C:\Windows\inf\RemoteAccess\0411\backup.exe
C:\Windows\inf\RemoteAccess\0411\backup.exe C:\Windows\inf\RemoteAccess\0411\
1⤵
PID:2464

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\
1⤵
PID:3040

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2504

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\
1⤵
PID:2800

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2076

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2336

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\
1⤵
PID:2428

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2568

C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\
1⤵
PID:1028
- C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\backup.exe
  "C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\
  2⤵
  PID:956

C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\
1⤵
PID:1512

C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\
1⤵
PID:2624

C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2984

C:\Windows\inf\ServiceModelService 3.0.0.0\0407\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0407\
1⤵
PID:2676

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\
1⤵
PID:652

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2584

C:\Windows\inf\SMSvcHost 3.0.0.0\0000\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0000\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0000\
1⤵
PID:2524

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1304

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\
1⤵
PID:1796

C:\Windows\inf\SMSvcHost 3.0.0.0\0411\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0411\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0411\
1⤵
PID:1736

C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\
1⤵
PID:824

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\
1⤵
PID:2168

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2920

C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\
1⤵
PID:324

C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\000B\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000B\
1⤵
PID:2524

C:\Windows\inf\SMSvcHost 4.0.0.0\000C\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\000C\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000C\
1⤵
PID:2440

C:\Windows\inf\SMSvcHost 4.0.0.0\000D\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\000D\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000D\
1⤵
PID:1644

C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\
1⤵
PID:1984

C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2212

C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0015\
1⤵
PID:1704

C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0404\
1⤵
PID:2192

C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0816\
1⤵
PID:2384

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\221fa10bd3cb407e43b7476af5039090\
1⤵
PID:1484

C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:3036

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\
1⤵
PID:3000

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\
1⤵
PID:2704

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\
1⤵
PID:2488

C:\Windows\inf\TermService\0411\backup.exe
C:\Windows\inf\TermService\0411\backup.exe C:\Windows\inf\TermService\0411\
1⤵
PID:1596

C:\Windows\inf\UGatherer\backup.exe
C:\Windows\inf\UGatherer\backup.exe C:\Windows\inf\UGatherer\
1⤵
PID:2712
- C:\Windows\inf\UGatherer\0407\backup.exe
  C:\Windows\inf\UGatherer\0407\backup.exe C:\Windows\inf\UGatherer\0407\
  2⤵
  PID:2400
- C:\Windows\inf\UGatherer\0410\backup.exe
  C:\Windows\inf\UGatherer\0410\backup.exe C:\Windows\inf\UGatherer\0410\
  2⤵
  PID:2388

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\
1⤵
PID:956

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2164

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\748de10ea72fad908022d9507c7304fc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\748de10ea72fad908022d9507c7304fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\748de10ea72fad908022d9507c7304fc\
1⤵
PID:280

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\
1⤵
PID:1608
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\
  2⤵
  PID:2020

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1196

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1680

C:\Windows\inf\UGTHRSVC\0000\backup.exe
C:\Windows\inf\UGTHRSVC\0000\backup.exe C:\Windows\inf\UGTHRSVC\0000\
1⤵
PID:2468

C:\Windows\inf\UGTHRSVC\0407\backup.exe
C:\Windows\inf\UGTHRSVC\0407\backup.exe C:\Windows\inf\UGTHRSVC\0407\
1⤵
PID:1564

C:\Windows\inf\UGTHRSVC\0409\backup.exe
C:\Windows\inf\UGTHRSVC\0409\backup.exe C:\Windows\inf\UGTHRSVC\0409\
1⤵
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
b3b939a737009934cc39004711c6743b

SHA1
7e0be018e19b41cd9250e695d21399e6e12db478

SHA256
44592cba37ebbe5804b74d24e069587d40331e3cf327cfa4c056c74930164e08

SHA512
6bb06826a04a74f2f0d986272bd12d224f37687f7dd94a517a019ac8343350f91d84427d19f926249e0362a8e1a8ece9cc63b6ce0e474a0f4e282cea7d28c07d

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
2859938becc4faed9ae6a27e2597d7b3

SHA1
9c5621ce41e1a75b10d9792127caea6a77e7a764

SHA256
64432171d325feb7b9c17e0c80b20266d02d12177403418977e2b890f3105858

SHA512
923c2e8e39d21046585362a937af5426e4fa8013e71b57889b54eea90137c93c7da8d62b6ea556c68e7ab8b46d4dc7927face37d2d56065ff99023a5ba36eb3e

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
1a7f5d52a37cc16d6ee966c965007797

SHA1
2b165b8e63fc76e6b68445bf3491d01664544f36

SHA256
e366a93b6b128810adb3cc8e5df20832c48cdc14d5da516b9a6b9cb5e08530e0

SHA512
011f630505284fda5ea6acbb45bb1d6ada110ddffd244724569a4955baad7bc8f60697588a24f40bbd5d17eab0b56ee110ff6d2582b332eb1f598c2bba1ff3db

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
bbc7db1511d7776878574d4612fc6ca0

SHA1
25a98343c20bbf9cb476cdaebf3edadc2fb60e72

SHA256
a4088c2e76f43af4df17643b05366c2f96c171baf9a367ca5d046b9a24812ffc

SHA512
b39c05dba5097c95512afd89989db6beab1b8a17e774c58e9b16ab9c998f6978ebd251daecdaba32083cd35ad12aaacaa8d66f10f02fc858166738bf603b2354

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
72KB

MD5
4d108debbcb9080e76947218143844d7

SHA1
6692d4bf893ebda04e5b7d3750c85ee746767c9b

SHA256
7a5ac996570bda9d1491badb56bd098f22ecc914ea1373efcb08fcae85cfb4ed

SHA512
ff3e8bf6eb3f976256848330f8778fefa2f0161129ac49d4880e3c5c58f77e0c5bd6a8143f7cf03243cb46e5edfae86331dfebc156c34a83e43cb25eda0e8382

Download Submit
\Users\Admin\AppData\Local\Temp\609472730\backup.exe

Filesize
72KB

MD5
a33112ae5baee4002ca7e05b2fc6be11

SHA1
316ad53c0697f752c23503ca170da61d21b5b79f

SHA256
e651cdf43f02e1cbc4dda8ef7cd9984647642f6ae7badbbd41a835a94fee0a6d

SHA512
6e86219b002fa5e5a0124a2d5e42f4bc6d0f2532f9fecf66ff3a9e3adcede6beca7848f87b53febce6a571ad3fed6c4a1c9151785d40353480066dd58f5a4f11

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2548_391778098\CRX_INSTALL\System Restore.exe

Filesize
72KB

MD5
7357d0bc833ba454f9ee3dab01f85ae9

SHA1
77585cf7e98450b7afc80bd3dcde5b51f56090ec

SHA256
25bc8e9bb8e3ee6c864de40af9aba0309e554659982d401df854a8cb6d000828

SHA512
f46ea855c139d44035ac84d38ff74c4a34a4ced9f1a3d8f7838140d1e6da415004ee7958a862b716b9b9885955e8c670d263a2c7f04906aa94f7a3d27055f0e1

Download Submit
memory/1416-23036-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1556-17759-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1680-21357-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2292-18621-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2372-20388-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2512-15750-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2564-18813-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2748-18091-0x0000000076FC0000-0x00000000770BA000-memory.dmp

Filesize
1000KB

Download
memory/2748-13557-0x0000000076FC0000-0x00000000770BA000-memory.dmp

Filesize
1000KB

Download
memory/2748-12944-0x0000000076FC0000-0x00000000770BA000-memory.dmp

Filesize
1000KB

Download
memory/2828-23897-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2992-23117-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads