876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe
Size

122KB
MD5

697aad2dad8020da21ee5a876d14a188
SHA1

e582b518710f66fadc5e37e30be6a6a6224a3f96
SHA256

876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82
SHA512

37034c94ac2b34da559c4da504fca487b9d4314368b1928a64e615fb895cae91aa6cd40e43434b84747ca688aef71ca31c060dd5afe507bbd4893d176acc7eba
SSDEEP

1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4r:6u8ANCUdgfmD7zey0KUj6TjR9i4r

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 33 IoCs

resource	yara_rule
behavioral1/memory/2088-1-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/files/0x0008000000015ca6-9.dat	UPX
behavioral1/memory/1740-14-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2312-27-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/files/0x000b000000016117-85.dat	UPX
behavioral1/files/0x0006000000016843-123.dat	UPX
behavioral1/memory/1328-144-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2512-140-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2852-138-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/files/0x002f00000001567f-164.dat	UPX
behavioral1/files/0x0007000000016c63-173.dat	UPX
behavioral1/files/0x0006000000016cb7-187.dat	UPX
behavioral1/files/0x0007000000016ce4-221.dat	UPX
behavioral1/memory/2924-254-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1356-266-0x0000000000230000-0x0000000000254000-memory.dmp	UPX
behavioral1/memory/1368-275-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1356-298-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1268-326-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1800-344-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2536-352-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2736-356-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2948-380-0x00000000002C0000-0x00000000002E4000-memory.dmp	UPX
behavioral1/memory/3000-403-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2836-410-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2560-415-0x0000000000500000-0x0000000000524000-memory.dmp	UPX
behavioral1/memory/2968-428-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2800-447-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2560-467-0x0000000000500000-0x0000000000524000-memory.dmp	UPX
behavioral1/memory/2560-481-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2100-539-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2000-551-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/996-590-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1812-602-0x0000000000400000-0x0000000000424000-memory.dmp	UPX

C:\Users\Admin\AppData\Local\Temp\876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe
"C:\Users\Admin\AppData\Local\Temp\876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe"
1⤵
PID:2088

C:\Program Files\7-Zip\Lang\backup.exe
"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
1⤵
PID:2388

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
1⤵
PID:1368

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:616

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
1⤵
PID:1800

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:2632

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:2560
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
  2⤵
  PID:2968
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:2800
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2780
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
  2⤵
  PID:1616

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:488

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:2424

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2100

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:2000

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2056

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:936

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:2312

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
1⤵
PID:2624

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:2448

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:2552
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:2780
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:2532
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:2236

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
1⤵
PID:412

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:1552

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:768

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2888
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:936
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:3056
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:2384

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2312
- C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
  2⤵
  PID:2892
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:1316
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:1100
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2620
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:1804

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:1992

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:3060

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
1⤵
PID:2780

C:\Program Files\Common Files\System\ado\update.exe
"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:336
- C:\Program Files\Common Files\System\ado\de-DE\backup.exe
  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
  2⤵
  PID:2532

C:\Program Files\Common Files\System\ja-JP\update.exe
"C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\
1⤵
PID:2264

C:\Program Files\Common Files\System\msadc\System Restore.exe
"C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:2536
- C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
  2⤵
  PID:1732
- C:\Program Files\Common Files\System\msadc\en-US\backup.exe
  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
  2⤵
  PID:2608
- C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
  2⤵
  PID:2452
- C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
  2⤵
  PID:2500

C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2584

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
1⤵
PID:2504

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:412

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
1⤵
PID:800

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
1⤵
PID:1716

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
1⤵
PID:2184

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
1⤵
PID:2896

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
1⤵
PID:1732

C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
1⤵
PID:2632

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\System Restore.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
1⤵
PID:700

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:1576
- C:\Program Files\Google\Chrome\Application\backup.exe
  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
  2⤵
  PID:2576
- - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
    3⤵
    PID:3012

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
1⤵
PID:1748

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
1⤵
PID:2860

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
1⤵
PID:304

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:2692
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
  2⤵
  PID:1196

C:\Program Files\Internet Explorer\es-ES\backup.exe
"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:1960

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:768

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:2064
- C:\Program Files\Java\jdk1.7.0_80\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
  2⤵
  PID:2136

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:1716

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:2896
- C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
  2⤵
  PID:1688

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:2744

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
1⤵
PID:2640

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
1⤵
PID:956
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
  2⤵
  PID:2388
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
  2⤵
  PID:2456
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
  2⤵
  PID:1036
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
  2⤵
  PID:304
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
  2⤵
  PID:1852
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
    3⤵
    PID:1968
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
      4⤵
      PID:1628
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
      4⤵
      PID:1676
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
    3⤵
    PID:1164
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
    3⤵
    PID:412
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
    3⤵
    PID:1532
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
    3⤵
    PID:2904
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
    3⤵
    PID:992

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
1⤵
PID:2504

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:1268
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
  2⤵
  PID:2264
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
  2⤵
  PID:2052
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:2688
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
    3⤵
    PID:2652
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
    3⤵
    PID:848
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
    3⤵
    PID:2068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:2768
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:2440
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
    3⤵
    PID:2588
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:760
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
    3⤵
    PID:3004
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
      4⤵
      PID:2580
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
    3⤵
    PID:2788
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2812
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:2780
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
    3⤵
    PID:1044
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
    3⤵
    PID:1260
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
  2⤵
  PID:2888
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
  2⤵
  PID:1600
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
    3⤵
    PID:2772
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
      4⤵
      PID:664
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
    3⤵
    PID:2464
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
      4⤵
      PID:3024

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2784

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:3036

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
1⤵
PID:448

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
1⤵
PID:2020

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:1684

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:2600

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:2184

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:848

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
1⤵
PID:2768
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
  2⤵
  PID:2820

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:532
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
  2⤵
  PID:1676

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
1⤵
PID:1164
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
  2⤵
  PID:880
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
    3⤵
    PID:1956
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
      4⤵
      PID:996
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
    3⤵
    PID:1040
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
    3⤵
    PID:1980
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
    3⤵
    PID:2968
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
  2⤵
  PID:2460
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
    3⤵
    PID:1100
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
      4⤵
      PID:1652

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:956

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
1⤵
PID:844

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
1⤵
PID:1712

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:2548

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
1⤵
PID:756

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:1492

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
1⤵
PID:2832

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2964

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
1⤵
PID:2928

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
1⤵
PID:2488

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:760

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
1⤵
PID:1660

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
1⤵
PID:1944

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:2572
- C:\Program Files\Java\jre7\bin\plugin2\backup.exe
  "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
  2⤵
  PID:892

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
1⤵
PID:3048

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:2668

C:\Program Files\Java\jre7\lib\cmm\backup.exe
"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
1⤵
PID:1716

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
1⤵
PID:2656

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
1⤵
PID:2620

C:\Program Files\Java\jre7\lib\jfr\backup.exe
"C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
1⤵
PID:2444

C:\Program Files\Java\jre7\lib\security\backup.exe
"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
1⤵
PID:2820

C:\Program Files\Java\jre7\lib\zi\backup.exe
"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
1⤵
PID:2024
- C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
  2⤵
  PID:2656
- C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
  2⤵
  PID:1484

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:2512

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:2088

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
1⤵
PID:2328

C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
1⤵
PID:632

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
1⤵
PID:1824
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
  2⤵
  PID:2816

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
1⤵
PID:2608

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
1⤵
PID:3044

C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
1⤵
PID:1784

C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe
"C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
1⤵
PID:2324

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
1⤵
PID:2524

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
1⤵
PID:2144

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:2260

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:1992

C:\Program Files\Microsoft Games\Mahjong\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:1984
- C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
  2⤵
  PID:2960
- C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
  2⤵
  PID:2612

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
1⤵
PID:1912

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
1⤵
PID:2340

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
1⤵
PID:2780
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:2904
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:920

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:1824

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
1⤵
PID:1488

C:\Program Files\Microsoft Games\More Games\es-ES\System Restore.exe
"C:\Program Files\Microsoft Games\More Games\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
1⤵
PID:1964

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
1⤵
PID:1512

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
1⤵
PID:2484

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
1⤵
PID:1388

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
1⤵
PID:2352

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
1⤵
PID:2640

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:1948

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
1⤵
PID:2728

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
1⤵
PID:1048

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
1⤵
PID:2252
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
  2⤵
  PID:676

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
1⤵
PID:2304

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
1⤵
PID:2312

C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
1⤵
PID:1108

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
1⤵
PID:2032

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
1⤵
PID:1284

C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
1⤵
PID:3020

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
1⤵
PID:2040

C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
1⤵
PID:2468

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:2456
- C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
  2⤵
  PID:308

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:1328

C:\Program Files\Microsoft Office\update.exe
"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\
1⤵
PID:904
- C:\Program Files\Microsoft Office\Office14\backup.exe
  "C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
  2⤵
  PID:664
- - C:\Program Files\Microsoft Office\Office14\1033\backup.exe
    "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
    3⤵
    PID:2524

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1976
- C:\Program Files\Mozilla Firefox\uninstall\backup.exe
  "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:2728

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
1⤵
PID:1836

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
1⤵
PID:2292

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:1100

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:1572

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
1⤵
PID:2796

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
1⤵
PID:2680

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
1⤵
PID:2336

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
1⤵
PID:2460

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
1⤵
PID:2672

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:2984
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
  2⤵
  PID:2972
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
  2⤵
  PID:2400
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
  2⤵
  PID:2740

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:2892

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
1⤵
PID:640

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:1928

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
1⤵
PID:2552

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
1⤵
PID:852

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
1⤵
PID:2128

C:\Program Files\VideoLAN\VLC\locale\am\data.exe
"C:\Program Files\VideoLAN\VLC\locale\am\data.exe" C:\Program Files\VideoLAN\VLC\locale\am\
1⤵
PID:2032
- C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
  2⤵
  PID:2872

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
1⤵
PID:1780

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
1⤵
PID:2572

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
1⤵
PID:1680

C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
1⤵
PID:3000

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
1⤵
PID:692

C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
1⤵
PID:2064

C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
1⤵
PID:2884

C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
1⤵
PID:2704
- C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
  2⤵
  PID:2548

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
1⤵
PID:2760
- C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\
  2⤵
  PID:3036
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\
    3⤵
    PID:664
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\
    3⤵
    PID:1032
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\
    3⤵
    PID:1448

C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
1⤵
PID:1516
- C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
  2⤵
  PID:2720

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\
1⤵
PID:2540

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
1⤵
PID:2820

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
1⤵
PID:2448

C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
1⤵
PID:632

C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
1⤵
PID:1648
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
  2⤵
  PID:1940

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
1⤵
PID:616

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\
1⤵
PID:2948
- C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\
  2⤵
  PID:1812

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
1⤵
PID:2020
- C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
  2⤵
  PID:1860

C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
1⤵
PID:2664
- C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
  2⤵
  PID:2592

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\
1⤵
PID:1716

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
1⤵
PID:2536
- C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\
  2⤵
  PID:696

C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
1⤵
PID:1260
- C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
  2⤵
  PID:836

C:\Program Files\VideoLAN\VLC\locale\cgg\update.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\update.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
1⤵
PID:2140

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\
1⤵
PID:2660

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
1⤵
PID:2508
- C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:2940

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
1⤵
PID:2548

C:\Program Files (x86)\Common Files\System\backup.exe
"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
1⤵
PID:2560
- C:\Program Files (x86)\Common Files\System\ado\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
  2⤵
  PID:2212
- - C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
    3⤵
    PID:2328
- - C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
    3⤵
    PID:1032
- - C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
    3⤵
    PID:2732
- C:\Program Files (x86)\Common Files\System\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
  2⤵
  PID:2804
- C:\Program Files (x86)\Common Files\System\es-ES\data.exe
  "C:\Program Files (x86)\Common Files\System\es-ES\data.exe" C:\Program Files (x86)\Common Files\System\es-ES\
  2⤵
  PID:1604
- C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
  2⤵
  PID:2736
- C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\
  2⤵
  PID:2852
- - C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\
    3⤵
    PID:2240
- - C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:1956
- - C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\update.exe
    "C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\update.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:1780

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
1⤵
PID:2236

C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
1⤵
PID:2612
- C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
  2⤵
  PID:1132

C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
1⤵
PID:2916

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
1⤵
PID:304

C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
1⤵
PID:1992

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
1⤵
PID:3044
- C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
  2⤵
  PID:676

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\data.exe
"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
1⤵
PID:348

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
1⤵
PID:1356
- C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
  2⤵
  PID:2748

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe
"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\
1⤵
PID:532

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:2916

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:2472
- C:\Program Files (x86)\Google\Update\backup.exe
  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
  2⤵
  PID:1760
- - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
    3⤵
    PID:1608
- - C:\Program Files (x86)\Google\Update\Install\backup.exe
    "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
    3⤵
    PID:1340

C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
1⤵
PID:2664
- C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
  2⤵
  PID:1488

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
1⤵
PID:2792

C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
1⤵
PID:2116
- C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
  2⤵
  PID:1668

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
1⤵
PID:960
- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
  2⤵
  PID:2456

C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
1⤵
PID:2480
- C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
  2⤵
  PID:2988

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
1⤵
PID:1628

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
1⤵
PID:880

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
1⤵
PID:1580

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
1⤵
PID:2036

C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe
"C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\
1⤵
PID:1780
- C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
  2⤵
  PID:2984
- - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe
    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
    3⤵
    PID:692
  - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
      "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
      4⤵
      PID:2064

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:3020

C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
1⤵
PID:1752

C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
1⤵
PID:1964

C:\Users\Admin\Contacts\backup.exe
C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
1⤵
PID:2492

C:\Users\Admin\Downloads\backup.exe
C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
1⤵
PID:2576

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:2224

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\
1⤵
PID:1272

C:\Users\Admin\Favorites\backup.exe
C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
1⤵
PID:1088

C:\Users\Admin\Links\backup.exe
C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
1⤵
PID:3024

C:\Users\Admin\Music\backup.exe
C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
1⤵
PID:2328

C:\Users\Admin\Pictures\backup.exe
C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
1⤵
PID:336

C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
1⤵
PID:2524

C:\Users\Admin\Saved Games\backup.exe
"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
1⤵
PID:664

C:\Users\Admin\Videos\backup.exe
C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
1⤵
PID:1532

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\System Restore.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
1⤵
PID:764

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:568

C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
1⤵
PID:1444
- C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
  2⤵
  PID:1860

C:\Users\Public\Documents\backup.exe
C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
1⤵
PID:2220

C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
1⤵
PID:1100
- C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
  2⤵
  PID:2712

C:\Users\Public\Music\backup.exe
C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
1⤵
PID:1728
- C:\Users\Public\Music\Sample Music\data.exe
  "C:\Users\Public\Music\Sample Music\data.exe" C:\Users\Public\Music\Sample Music\
  2⤵
  PID:1608

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe
"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\
1⤵
PID:996

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:2836

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:800

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\
1⤵
PID:2336

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\
1⤵
PID:2088
- C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe
  "C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe
  "C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\
  2⤵
  PID:1044

C:\Users\Public\Recorded TV\backup.exe
"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
1⤵
PID:1720

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
1⤵
PID:2908

C:\Users\Public\Videos\data.exe
C:\Users\Public\Videos\data.exe C:\Users\Public\Videos\
1⤵
PID:1108
- C:\Users\Public\Videos\Sample Videos\backup.exe
  "C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
  2⤵
  PID:2240

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:1268

C:\Program Files\VideoLAN\VLC\locale\ky\data.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\data.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
1⤵
PID:1940

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:1932
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:568
- C:\Windows\AppCompat\backup.exe
  C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
  2⤵
  PID:2688
- C:\Windows\Cursors\backup.exe
  C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
  2⤵
  PID:2552
- C:\Windows\DigitalLocker\backup.exe
  C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
  2⤵
  PID:2664
- - C:\Windows\DigitalLocker\de-DE\backup.exe
    C:\Windows\DigitalLocker\de-DE\backup.exe C:\Windows\DigitalLocker\de-DE\
    3⤵
    PID:2180
- - C:\Windows\DigitalLocker\es-ES\backup.exe
    C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
    3⤵
    PID:2596
- - C:\Windows\DigitalLocker\it-IT\backup.exe
    C:\Windows\DigitalLocker\it-IT\backup.exe C:\Windows\DigitalLocker\it-IT\
    3⤵
    PID:1816
- C:\Windows\ehome\update.exe
  C:\Windows\ehome\update.exe C:\Windows\ehome\
  2⤵
  PID:936
- - C:\Windows\ehome\CreateDisc\backup.exe
    C:\Windows\ehome\CreateDisc\backup.exe C:\Windows\ehome\CreateDisc\
    3⤵
    PID:2896
  - - C:\Windows\ehome\CreateDisc\Styles\backup.exe
      C:\Windows\ehome\CreateDisc\Styles\backup.exe C:\Windows\ehome\CreateDisc\Styles\
      4⤵
      PID:2516
    - - C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe
        
        C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\
        5⤵
        
        PID:892
      - C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe
        
        C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\
        6⤵
        
        PID:1724
        
        C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe
        
        C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\
        7⤵
        
        PID:2592
- - C:\Windows\ehome\de-DE\backup.exe
    C:\Windows\ehome\de-DE\backup.exe C:\Windows\ehome\de-DE\
    3⤵
    PID:2584
- - C:\Windows\ehome\it-IT\System Restore.exe
    "C:\Windows\ehome\it-IT\System Restore.exe" C:\Windows\ehome\it-IT\
    3⤵
    PID:2132
- C:\Windows\Fonts\data.exe
  C:\Windows\Fonts\data.exe C:\Windows\Fonts\
  2⤵
  PID:3032
- C:\Windows\Globalization\backup.exe
  C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
  2⤵
  PID:1268
- - C:\Windows\Globalization\ELS\backup.exe
    C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
    3⤵
    PID:1548
- C:\Windows\inf\backup.exe
  C:\Windows\inf\backup.exe C:\Windows\inf\
  2⤵
  PID:2708
- - C:\Windows\inf\aspnet_state\data.exe
    C:\Windows\inf\aspnet_state\data.exe C:\Windows\inf\aspnet_state\
    3⤵
    PID:1712
  - - C:\Windows\inf\aspnet_state\0001\backup.exe
      C:\Windows\inf\aspnet_state\0001\backup.exe C:\Windows\inf\aspnet_state\0001\
      4⤵
      PID:908
  - - C:\Windows\inf\aspnet_state\0006\backup.exe
      C:\Windows\inf\aspnet_state\0006\backup.exe C:\Windows\inf\aspnet_state\0006\
      4⤵
      PID:2000
  - - C:\Windows\inf\aspnet_state\0008\backup.exe
      C:\Windows\inf\aspnet_state\0008\backup.exe C:\Windows\inf\aspnet_state\0008\
      4⤵
      PID:348
  - - C:\Windows\inf\aspnet_state\000A\backup.exe
      C:\Windows\inf\aspnet_state\000A\backup.exe C:\Windows\inf\aspnet_state\000A\
      4⤵
      PID:2464
  - - C:\Windows\inf\aspnet_state\000D\backup.exe
      C:\Windows\inf\aspnet_state\000D\backup.exe C:\Windows\inf\aspnet_state\000D\
      4⤵
      PID:2072
  - - C:\Windows\inf\aspnet_state\0010\backup.exe
      C:\Windows\inf\aspnet_state\0010\backup.exe C:\Windows\inf\aspnet_state\0010\
      4⤵
      PID:2040
- - C:\Windows\inf\BITS\backup.exe
    C:\Windows\inf\BITS\backup.exe C:\Windows\inf\BITS\
    3⤵
    PID:936
  - - C:\Windows\inf\BITS\0407\backup.exe
      C:\Windows\inf\BITS\0407\backup.exe C:\Windows\inf\BITS\0407\
      4⤵
      PID:1936
  - - C:\Windows\inf\BITS\0409\backup.exe
      C:\Windows\inf\BITS\0409\backup.exe C:\Windows\inf\BITS\0409\
      4⤵
      PID:2892
  - - C:\Windows\inf\BITS\0411\backup.exe
      C:\Windows\inf\BITS\0411\backup.exe C:\Windows\inf\BITS\0411\
      4⤵
      PID:2772
- - C:\Windows\inf\ESENT\backup.exe
    C:\Windows\inf\ESENT\backup.exe C:\Windows\inf\ESENT\
    3⤵
    PID:1552
  - - C:\Windows\inf\ESENT\0000\backup.exe
      C:\Windows\inf\ESENT\0000\backup.exe C:\Windows\inf\ESENT\0000\
      4⤵
      PID:2400
  - - C:\Windows\inf\ESENT\040C\backup.exe
      C:\Windows\inf\ESENT\040C\backup.exe C:\Windows\inf\ESENT\040C\
      4⤵
      PID:2828
  - - C:\Windows\inf\ESENT\0411\backup.exe
      C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
      4⤵
      PID:2748
  - - C:\Windows\inf\ESENT\0C0A\backup.exe
      C:\Windows\inf\ESENT\0C0A\backup.exe C:\Windows\inf\ESENT\0C0A\
      4⤵
      PID:2516
- - C:\Windows\inf\fr-FR\backup.exe
    C:\Windows\inf\fr-FR\backup.exe C:\Windows\inf\fr-FR\
    3⤵
    PID:2636
- - C:\Windows\inf\MSDTC\backup.exe
    C:\Windows\inf\MSDTC\backup.exe C:\Windows\inf\MSDTC\
    3⤵
    PID:2896
  - - C:\Windows\inf\MSDTC\0410\backup.exe
      C:\Windows\inf\MSDTC\0410\backup.exe C:\Windows\inf\MSDTC\0410\
      4⤵
      PID:2168
  - - C:\Windows\inf\MSDTC\0C0A\backup.exe
      C:\Windows\inf\MSDTC\0C0A\backup.exe C:\Windows\inf\MSDTC\0C0A\
      4⤵
      PID:2492
- - C:\Windows\inf\PERFLIB\update.exe
    C:\Windows\inf\PERFLIB\update.exe C:\Windows\inf\PERFLIB\
    3⤵
    PID:1756
  - - C:\Windows\inf\PERFLIB\0407\backup.exe
      C:\Windows\inf\PERFLIB\0407\backup.exe C:\Windows\inf\PERFLIB\0407\
      4⤵
      PID:2912
  - - C:\Windows\inf\PERFLIB\0409\backup.exe
      C:\Windows\inf\PERFLIB\0409\backup.exe C:\Windows\inf\PERFLIB\0409\
      4⤵
      PID:1580
- - C:\Windows\inf\rdyboost\backup.exe
    C:\Windows\inf\rdyboost\backup.exe C:\Windows\inf\rdyboost\
    3⤵
    PID:2964
  - - C:\Windows\inf\rdyboost\0000\backup.exe
      C:\Windows\inf\rdyboost\0000\backup.exe C:\Windows\inf\rdyboost\0000\
      4⤵
      PID:1708
  - - C:\Windows\inf\rdyboost\040C\backup.exe
      C:\Windows\inf\rdyboost\040C\backup.exe C:\Windows\inf\rdyboost\040C\
      4⤵
      PID:1336
  - - C:\Windows\inf\rdyboost\0C0A\backup.exe
      C:\Windows\inf\rdyboost\0C0A\backup.exe C:\Windows\inf\rdyboost\0C0A\
      4⤵
      PID:2144
- - C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe
    "C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\
    3⤵
    PID:884
  - - C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe
      "C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\
      4⤵
      PID:2180
  - - C:\Windows\inf\ServiceModelOperation 3.0.0.0\0411\backup.exe
      "C:\Windows\inf\ServiceModelOperation 3.0.0.0\0411\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0411\
      4⤵
      PID:2480
- C:\Windows\ja-JP\backup.exe
  C:\Windows\ja-JP\backup.exe C:\Windows\ja-JP\
  2⤵
  PID:1036

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\
1⤵
PID:1252

C:\Windows\AppPatch\AppPatch64\backup.exe
C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
1⤵
PID:2856

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:2468

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\
1⤵
PID:1936
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
  2⤵
  PID:2176

C:\Windows\AppPatch\it-IT\backup.exe
C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\
1⤵
PID:1500

C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
1⤵
PID:1028
- C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
  2⤵
  PID:272

C:\Windows\assembly\GAC\Extensibility\backup.exe
C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
1⤵
PID:1748

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\
1⤵
PID:1972
- C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\
  2⤵
  PID:1100

C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
1⤵
PID:2228

C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
1⤵
PID:2600

C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
1⤵
PID:564
- C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
  2⤵
  PID:1656

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
1⤵
PID:892

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
1⤵
PID:2100

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
1⤵
PID:2928

C:\Program Files (x86)\Microsoft Office\Office14\3082\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\3082\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\3082\
1⤵
PID:2900

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2560

C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
1⤵
PID:904

C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\
1⤵
PID:2632

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:1948

C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
1⤵
PID:2948
- C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
  2⤵
  PID:2500

C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
1⤵
PID:2792
- C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
  2⤵
  PID:1704

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:1864
- C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2288

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\
1⤵
PID:1668
- C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\
  2⤵
  PID:2532

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
1⤵
PID:2448

C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
1⤵
PID:532
- C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
  2⤵
  PID:960

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\
1⤵
PID:2096

C:\Windows\assembly\GAC_32\ehexthost32\backup.exe
C:\Windows\assembly\GAC_32\ehexthost32\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\
1⤵
PID:2944

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\
1⤵
PID:2436
- C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\
  2⤵
  PID:1816

C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
1⤵
PID:1352
- C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
  2⤵
  PID:2528

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1580

C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
1⤵
PID:2740

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:1244

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\
1⤵
PID:1608
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1976
- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
  2⤵
  PID:696

C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\
1⤵
PID:1872
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\
  2⤵
  PID:2520
- - C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\data.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\
    3⤵
    PID:2688

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\
1⤵
PID:304
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\
  2⤵
  PID:3048

C:\Program Files\VideoLAN\VLC\locale\ru\data.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\data.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
1⤵
PID:2716

C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
1⤵
PID:1432

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:2020

C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
1⤵
PID:1812

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\
1⤵
PID:1820

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\
1⤵
PID:2620

C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
1⤵
PID:3064

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\
1⤵
PID:2336
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\
  2⤵
  PID:2712

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1796

C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
1⤵
PID:2472

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2536

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\
1⤵
PID:2760

C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
1⤵
PID:1580

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\
1⤵
PID:1948

C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
1⤵
PID:2504
- C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
  2⤵
  PID:1444

C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
1⤵
PID:1492

C:\Windows\assembly\GAC_32\mscorlib\backup.exe
C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\
1⤵
PID:1388

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\
1⤵
PID:2056

C:\Windows\assembly\GAC_32\napcrypt\System Restore.exe
"C:\Windows\assembly\GAC_32\napcrypt\System Restore.exe" C:\Windows\assembly\GAC_32\napcrypt\
1⤵
PID:892
- C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1836

C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
1⤵
PID:1032

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\
1⤵
PID:1640

C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:800

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\
1⤵
PID:296

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:2068

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2112

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2264

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1864

C:\Program Files\VideoLAN\VLC\locale\zu\data.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\data.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
1⤵
PID:336
- C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
  2⤵
  PID:2748

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\
1⤵
PID:2284
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\data.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\
  2⤵
  PID:768

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:1564

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:2020
- C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
  2⤵
  PID:1836
- C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
  2⤵
  PID:664
- - C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
    3⤵
    PID:2088
- C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
  2⤵
  PID:1252

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\
1⤵
PID:1640
- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2220

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
1⤵
PID:2496

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\update.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\update.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
1⤵
PID:2612

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:2180

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
1⤵
PID:1720

C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
1⤵
PID:2228

C:\Windows\assembly\GAC_32\System.Web\backup.exe
C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\
1⤵
PID:2116

C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2308

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:3012
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:1976

C:\Windows\assembly\GAC_64\BDATunePIA\data.exe
C:\Windows\assembly\GAC_64\BDATunePIA\data.exe C:\Windows\assembly\GAC_64\BDATunePIA\
1⤵
PID:920

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\
1⤵
PID:1940

C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
1⤵
PID:2456

C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
1⤵
PID:640

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:2076
- C:\Program Files\Windows Journal\de-DE\data.exe
  "C:\Program Files\Windows Journal\de-DE\data.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:2244
- C:\Program Files\Windows Journal\it-IT\backup.exe
  "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
  2⤵
  PID:1936

C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\
1⤵
PID:992

C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
1⤵
PID:1676

C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1588

C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\meta_engine\
1⤵
PID:1972

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2932

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:1564
- C:\Program Files\Windows Mail\ja-JP\backup.exe
  "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
  2⤵
  PID:600

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2664

C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\
1⤵
PID:2632

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
1⤵
PID:2500
- C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2448

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:1964
- C:\Program Files\Windows Media Player\en-US\backup.exe
  "C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
  2⤵
  PID:2964
- C:\Program Files\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
  2⤵
  PID:2944
- C:\Program Files\Windows Media Player\ja-JP\backup.exe
  "C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
  2⤵
  PID:1952

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\
1⤵
PID:2828

C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_out\
1⤵
PID:304

C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\text_renderer\
1⤵
PID:2256

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\
1⤵
PID:1608

C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\
1⤵
PID:1780

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2708

C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\
1⤵
PID:2860

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\
1⤵
PID:348
- C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1092

C:\Program Files (x86)\Microsoft Office\Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\
1⤵
PID:2524

C:\Program Files\Windows NT\Accessories\backup.exe
"C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
1⤵
PID:1356
- C:\Program Files\Windows NT\Accessories\en-US\backup.exe
  "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
  2⤵
  PID:2144
- C:\Program Files\Windows NT\Accessories\it-IT\backup.exe
  "C:\Program Files\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files\Windows NT\Accessories\it-IT\
  2⤵
  PID:1528

C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
1⤵
PID:1004
- C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2512

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:1296

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\
1⤵
PID:1684

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\
1⤵
PID:1708

C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1028

C:\Windows\assembly\GAC_64\MSBuild\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\
1⤵
PID:2464

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
1⤵
PID:2680

C:\Program Files\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files\Windows NT\TableTextService\en-US\
1⤵
PID:836

C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe
"C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files\Windows NT\TableTextService\fr-FR\
1⤵
PID:2444

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
1⤵
PID:3040

C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2584

C:\Windows\assembly\GAC_64\naphlpr\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\backup.exe C:\Windows\assembly\GAC_64\naphlpr\
1⤵
PID:1432

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:1944
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:1268

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\data.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\data.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:1308
- C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
  2⤵
  PID:2424

C:\Program Files\Windows Photo Viewer\System Restore.exe
"C:\Program Files\Windows Photo Viewer\System Restore.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:1368
- C:\Program Files\Windows Photo Viewer\de-DE\backup.exe
  "C:\Program Files\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files\Windows Photo Viewer\de-DE\
  2⤵
  PID:2888
- C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
  "C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
  2⤵
  PID:2112
- C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe
  "C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files\Windows Photo Viewer\ja-JP\
  2⤵
  PID:1728

C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:2492
- C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
  2⤵
  PID:2052

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System Restore.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\
1⤵
PID:1364

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\
1⤵
PID:2704
- C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1572

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\
1⤵
PID:2212

C:\Program Files\Windows Sidebar\en-US\backup.exe
"C:\Program Files\Windows Sidebar\en-US\backup.exe" C:\Program Files\Windows Sidebar\en-US\
1⤵
PID:1940

C:\Program Files\Windows Sidebar\es-ES\data.exe
"C:\Program Files\Windows Sidebar\es-ES\data.exe" C:\Program Files\Windows Sidebar\es-ES\
1⤵
PID:2320

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
1⤵
PID:2036

C:\Program Files\Windows Sidebar\Gadgets\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\
1⤵
PID:1352
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\
  2⤵
  PID:2872
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\
  2⤵
  PID:2468
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\
    3⤵
    PID:2472
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\
    3⤵
    PID:2156
  - - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
      4⤵
      PID:1812
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\
    3⤵
    PID:960
  - - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\
      4⤵
      PID:1552
  - - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
      4⤵
      PID:2508
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\
    3⤵
    PID:2276
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
    3⤵
    PID:1448
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\
  2⤵
  PID:2420
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\
    3⤵
    PID:2304
- - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\
    3⤵
    PID:2448
  - - C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\
      4⤵
      PID:2492

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2980

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\
1⤵
PID:800
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\
  2⤵
  PID:1512

C:\Windows\assembly\GAC_64\System.Printing\backup.exe
C:\Windows\assembly\GAC_64\System.Printing\backup.exe C:\Windows\assembly\GAC_64\System.Printing\
1⤵
PID:3012

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\
1⤵
PID:2436

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\
1⤵
PID:2460
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\
  2⤵
  PID:2600
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\
    3⤵
    PID:1636

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
1⤵
PID:1760

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
1⤵
PID:2588

C:\Windows\assembly\GAC_MSIL\backup.exe
C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\
1⤵
PID:760
- C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
  C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
  2⤵
  PID:2448
- - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1796
- C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
  C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
  2⤵
  PID:1968
- C:\Windows\assembly\GAC_MSIL\ehCIR\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehCIR\backup.exe C:\Windows\assembly\GAC_MSIL\ehCIR\
  2⤵
  PID:2220
- C:\Windows\assembly\GAC_MSIL\ehiActivScp\data.exe
  C:\Windows\assembly\GAC_MSIL\ehiActivScp\data.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\
  2⤵
  PID:2548
- - C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2812
- C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\
  2⤵
  PID:2460
- C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe C:\Windows\assembly\GAC_MSIL\ehiExtens\
  2⤵
  PID:2256
- - C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:1576
- C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\backup.exe C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\
  2⤵
  PID:1500
- - C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2492
- C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\
  2⤵
  PID:2392
- - C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2476
- C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiVidCtl\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\
  2⤵
  PID:2848
- - C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2284
- C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiWUapi\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\
  2⤵
  PID:996
- - C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:2920
- C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\
  2⤵
  PID:1760
- C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe
  C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\
  2⤵
  PID:1648
- C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe
  C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\
  2⤵
  PID:2124
- - C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:336
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\
  2⤵
  PID:2460
- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\
  2⤵
  PID:1764
- - C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\
    3⤵
    PID:448
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\
  2⤵
  PID:1968
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\
  2⤵
  PID:3024
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\
  2⤵
  PID:2740
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2288
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\
  2⤵
  PID:1668
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\
  2⤵
  PID:596
- C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\
  2⤵
  PID:2928
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\
    3⤵
    PID:1196
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
  2⤵
  PID:2956
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\
  2⤵
  PID:3028
- - C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
    3⤵
    PID:1808
- - C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
    3⤵
    PID:1040
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\
  2⤵
  PID:2888
- - C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:600
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\
  2⤵
  PID:2728
- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\
  2⤵
  PID:1704
- - C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\
    3⤵
    PID:936
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\data.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\
  2⤵
  PID:1512
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\
  2⤵
  PID:1572
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\
  2⤵
  PID:868
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\
  2⤵
  PID:1804
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\
  2⤵
  PID:936
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\
  2⤵
  PID:1972
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
    3⤵
    PID:580
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\
  2⤵
  PID:1048
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
  2⤵
  PID:2956
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
  2⤵
  PID:3020
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2624
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\
  2⤵
  PID:2428
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\
  2⤵
  PID:2052
- - C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
    3⤵
    PID:296
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\
  2⤵
  PID:336
- - C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\
    3⤵
    PID:908
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\
  2⤵
  PID:2904
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\
  2⤵
  PID:1984

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
1⤵
PID:2496

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:896

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:580

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\System Restore.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\System Restore.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\
1⤵
PID:2124

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\
1⤵
PID:2684

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\
1⤵
PID:1960

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\
1⤵
PID:920

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:1916
- C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\data.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\data.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
  2⤵
  PID:3004

C:\Program Files (x86)\Reference Assemblies\backup.exe
"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:1976

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:2692

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
1⤵
PID:3028
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\
  2⤵
  PID:1244
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\
    3⤵
    PID:2224
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
    3⤵
    PID:1268
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
    3⤵
    PID:1720
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
  2⤵
  PID:800
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
    3⤵
    PID:2732
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
    3⤵
    PID:1984
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\
    3⤵
    PID:920

C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1292

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\
1⤵
PID:2572

C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1752

C:\Windows\Branding\Basebrd\backup.exe
C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
1⤵
PID:2424
- C:\Windows\Branding\Basebrd\en-US\update.exe
  C:\Windows\Branding\Basebrd\en-US\update.exe C:\Windows\Branding\Basebrd\en-US\
  2⤵
  PID:2948
- C:\Windows\Branding\Basebrd\fr-FR\backup.exe
  C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
  2⤵
  PID:1660
- C:\Windows\Branding\Basebrd\it-IT\backup.exe
  C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
  2⤵
  PID:2388
- C:\Windows\Branding\Basebrd\ja-JP\backup.exe
  C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\
  2⤵
  PID:2224

C:\Program Files (x86)\Windows Defender\de-DE\backup.exe
"C:\Program Files (x86)\Windows Defender\de-DE\backup.exe" C:\Program Files (x86)\Windows Defender\de-DE\
1⤵
PID:1720

C:\Windows\debug\WIA\backup.exe
C:\Windows\debug\WIA\backup.exe C:\Windows\debug\WIA\
1⤵
PID:2352

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:2244
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
  2⤵
  PID:540

C:\Program Files (x86)\Windows Defender\it-IT\backup.exe
"C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\
1⤵
PID:2628

C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
1⤵
PID:2176

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1812

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2384

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\
1⤵
PID:800

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\
1⤵
PID:2108

C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2740

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:2496

C:\Program Files (x86)\Windows Media Player\fr-FR\data.exe
"C:\Program Files (x86)\Windows Media Player\fr-FR\data.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
1⤵
PID:2864

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
1⤵
PID:2252
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\
  2⤵
  PID:1824
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
  2⤵
  PID:1532

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:596

C:\Program Files (x86)\Windows Media Player\Network Sharing\update.exe
"C:\Program Files (x86)\Windows Media Player\Network Sharing\update.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\
1⤵
PID:1040

C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
"C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
1⤵
PID:2936

C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe
"C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\
1⤵
PID:2692

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
1⤵
PID:2680

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\
1⤵
PID:1356

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1596

C:\Program Files (x86)\Windows NT\Accessories\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\
1⤵
PID:2392
- C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\de-DE\
  2⤵
  PID:1996
- C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\es-ES\
  2⤵
  PID:2644
- C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\it-IT\
  2⤵
  PID:1580
- C:\Program Files (x86)\Windows NT\Accessories\ja-JP\System Restore.exe
  "C:\Program Files (x86)\Windows NT\Accessories\ja-JP\System Restore.exe" C:\Program Files (x86)\Windows NT\Accessories\ja-JP\
  2⤵
  PID:2592

C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\backup.exe
C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\
1⤵
PID:1756

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
1⤵
PID:2884

C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1656

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
1⤵
PID:2472

C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
1⤵
PID:696

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
1⤵
PID:2436
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\
  2⤵
  PID:2524

C:\Windows\ehome\MCX\X02\backup.exe
C:\Windows\ehome\MCX\X02\backup.exe C:\Windows\ehome\MCX\X02\
1⤵
PID:2464

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:320

C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
1⤵
PID:1060

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2300

C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\es-ES\
1⤵
PID:3056

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
1⤵
PID:2976

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\
1⤵
PID:1624

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\
1⤵
PID:1564

C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\es-ES\
1⤵
PID:2720

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2248

C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
1⤵
PID:2468

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\
1⤵
PID:1048

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:568

C:\Program Files (x86)\Windows Sidebar\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\en-US\
1⤵
PID:2852

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:2312

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2304

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2864

C:\Windows\Help\Help\de-DE\backup.exe
C:\Windows\Help\Help\de-DE\backup.exe C:\Windows\Help\Help\de-DE\
1⤵
PID:2872

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
1⤵
PID:1748
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
  2⤵
  PID:2668

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2468

C:\Windows\Help\Help\es-ES\backup.exe
C:\Windows\Help\Help\es-ES\backup.exe C:\Windows\Help\Help\es-ES\
1⤵
PID:3008

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
1⤵
PID:1772

C:\Windows\Help\Help\it-IT\backup.exe
C:\Windows\Help\Help\it-IT\backup.exe C:\Windows\Help\Help\it-IT\
1⤵
PID:1100

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:2932

C:\Windows\Help\mui\0407\backup.exe
C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
1⤵
PID:2656

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\
1⤵
PID:2948
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
  2⤵
  PID:1724

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\
1⤵
PID:588

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2496

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
1⤵
PID:1448

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
1⤵
PID:2976

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:348

C:\Windows\Help\OEM\backup.exe
C:\Windows\Help\OEM\backup.exe C:\Windows\Help\OEM\
1⤵
PID:564

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1632

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\
1⤵
PID:2608

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\
1⤵
PID:1048

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\
1⤵
PID:1820
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
  2⤵
  PID:1624

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\
1⤵
PID:756

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:1044

C:\Windows\Help\Windows\de-DE\backup.exe
C:\Windows\Help\Windows\de-DE\backup.exe C:\Windows\Help\Windows\de-DE\
1⤵
PID:2032

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
1⤵
PID:2724

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2076

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\
1⤵
PID:2064
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\
  2⤵
  PID:1828
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\System Restore.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
  2⤵
  PID:3068

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:916

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2556

C:\Windows\Help\Windows\ja-JP\backup.exe
C:\Windows\Help\Windows\ja-JP\backup.exe C:\Windows\Help\Windows\ja-JP\
1⤵
PID:1572

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2512

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:1512

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
1⤵
PID:2452

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:1988

C:\Windows\IME\IMEJP10\backup.exe
C:\Windows\IME\IMEJP10\backup.exe C:\Windows\IME\IMEJP10\
1⤵
PID:2836
- C:\Windows\IME\IMEJP10\help\backup.exe
  C:\Windows\IME\IMEJP10\help\backup.exe C:\Windows\IME\IMEJP10\help\
  2⤵
  PID:1108

C:\Windows\IME\imekr8\backup.exe
C:\Windows\IME\imekr8\backup.exe C:\Windows\IME\imekr8\
1⤵
PID:3048

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\
1⤵
PID:2804

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:1032

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:3004

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
1⤵
PID:1368

C:\Windows\IME\IMESC5\HELP\backup.exe
C:\Windows\IME\IMESC5\HELP\backup.exe C:\Windows\IME\IMESC5\HELP\
1⤵
PID:2412

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
1⤵
PID:2512

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\
1⤵
PID:2828

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2304

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1492

C:\Windows\inf\ASP.NET\0005\backup.exe
C:\Windows\inf\ASP.NET\0005\backup.exe C:\Windows\inf\ASP.NET\0005\
1⤵
PID:2812

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:676

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\
1⤵
PID:1816

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\
1⤵
PID:1732

C:\Windows\inf\ASP.NET\0007\backup.exe
C:\Windows\inf\ASP.NET\0007\backup.exe C:\Windows\inf\ASP.NET\0007\
1⤵
PID:776

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:3068
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
  2⤵
  PID:2608

C:\Windows\inf\ASP.NET\0008\backup.exe
C:\Windows\inf\ASP.NET\0008\backup.exe C:\Windows\inf\ASP.NET\0008\
1⤵
PID:2796

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2036

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
1⤵
PID:1308

C:\Windows\inf\ASP.NET\0009\backup.exe
C:\Windows\inf\ASP.NET\0009\backup.exe C:\Windows\inf\ASP.NET\0009\
1⤵
PID:2900

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
1⤵
PID:812

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2784

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
1⤵
PID:1708

C:\Windows\inf\ASP.NET\000B\backup.exe
C:\Windows\inf\ASP.NET\000B\backup.exe C:\Windows\inf\ASP.NET\000B\
1⤵
PID:2872

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:1928
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\
  2⤵
  PID:2840

C:\Windows\inf\ASP.NET\000E\backup.exe
C:\Windows\inf\ASP.NET\000E\backup.exe C:\Windows\inf\ASP.NET\000E\
1⤵
PID:1604

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\
1⤵
PID:3056

C:\Windows\inf\ASP.NET\0010\backup.exe
C:\Windows\inf\ASP.NET\0010\backup.exe C:\Windows\inf\ASP.NET\0010\
1⤵
PID:1624

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:2248

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
1⤵
PID:2792

C:\Windows\inf\ASP.NET\0013\backup.exe
C:\Windows\inf\ASP.NET\0013\backup.exe C:\Windows\inf\ASP.NET\0013\
1⤵
PID:1680

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
1⤵
PID:2660

C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\
1⤵
PID:1036
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\
  2⤵
  PID:2584

C:\Windows\inf\ASP.NET\0015\update.exe
C:\Windows\inf\ASP.NET\0015\update.exe C:\Windows\inf\ASP.NET\0015\
1⤵
PID:696

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\
1⤵
PID:2428

C:\Windows\inf\ASP.NET\001D\backup.exe
C:\Windows\inf\ASP.NET\001D\backup.exe C:\Windows\inf\ASP.NET\001D\
1⤵
PID:1100

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
1⤵
PID:1624

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\
1⤵
PID:1576

C:\Windows\inf\ASP.NET\0404\backup.exe
C:\Windows\inf\ASP.NET\0404\backup.exe C:\Windows\inf\ASP.NET\0404\
1⤵
PID:2448

C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\
1⤵
PID:676

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
1⤵
PID:1032

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\
1⤵
PID:2684

C:\Windows\inf\ASP.NET\0804\backup.exe
C:\Windows\inf\ASP.NET\0804\backup.exe C:\Windows\inf\ASP.NET\0804\
1⤵
PID:2664

C:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0000\
1⤵
PID:836

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
1⤵
PID:2256

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2016

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\
1⤵
PID:1580

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\
1⤵
PID:1316

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\
1⤵
PID:2212
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\
  2⤵
  PID:1356

C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0008\
1⤵
PID:2744

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\
1⤵
PID:696

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
1⤵
PID:2604

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\5cd902459c588bb0ac608d4cbc8b5e4c\
1⤵
PID:1196

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:3056

C:\Windows\inf\ASP.NET_4.0.30319\000A\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000A\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000A\
1⤵
PID:1756

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2468

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
1⤵
PID:2876

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\
1⤵
PID:2608

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\
1⤵
PID:2784

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\
1⤵
PID:1672
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\
  2⤵
  PID:884

C:\Windows\inf\ASP.NET_4.0.30319\000B\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000B\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000B\
1⤵
PID:844

C:\Windows\inf\ASP.NET_4.0.30319\000C\update.exe
C:\Windows\inf\ASP.NET_4.0.30319\000C\update.exe C:\Windows\inf\ASP.NET_4.0.30319\000C\
1⤵
PID:1976

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\e05e6f6ef788b8973bbedf258216c972\
1⤵
PID:1088

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:700

C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0014\
1⤵
PID:2240

C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0015\
1⤵
PID:2316

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\
1⤵
PID:2680

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\
1⤵
PID:2980

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1772

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\
1⤵
PID:2136
- C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\740a64a316ada107a23dd34f35ae3b94\
  2⤵
  PID:3060

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:2452

C:\Windows\inf\ASP.NET_4.0.30319\0416\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0416\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0416\
1⤵
PID:2768

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\
1⤵
PID:836

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\
1⤵
PID:2616

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\
1⤵
PID:2984

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\c285072157ebf5c07677e9d813ba45d4\
1⤵
PID:2088

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\
1⤵
PID:2728

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
1⤵
PID:2236

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\
1⤵
PID:880

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\
1⤵
PID:2624

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2056

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\
1⤵
PID:1340
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
  2⤵
  PID:2964
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\
    3⤵
    PID:1656
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\
  2⤵
  PID:1108
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\
  2⤵
  PID:880

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\
1⤵
PID:768

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2456

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\
1⤵
PID:1576
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\
  2⤵
  PID:2460

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\
1⤵
PID:1608

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:812

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\
1⤵
PID:2860

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\
1⤵
PID:2784

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:1916
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\System Restore.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
  2⤵
  PID:812

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\
1⤵
PID:948

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\
1⤵
PID:2296

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\
1⤵
PID:1356
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
  2⤵
  PID:764

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:852

C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\it-IT\
1⤵
PID:1828

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\
1⤵
PID:768

C:\Program Files (x86)\Windows Sidebar\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\ja-JP\
1⤵
PID:1756

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\
1⤵
PID:1760
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\
  2⤵
  PID:2132

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\
1⤵
PID:1996

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\
1⤵
PID:2020

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2548

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
1⤵
PID:1928

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1328

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\
1⤵
PID:2988

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\
1⤵
PID:2584

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2756

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\ff7aa68fbf75e4b7ca80813225c3db01\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\ff7aa68fbf75e4b7ca80813225c3db01\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\ff7aa68fbf75e4b7ca80813225c3db01\
1⤵
PID:2248

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\
1⤵
PID:2812

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2064

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1612

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3008a05e2928e2c1d856cc34e0422c17\
1⤵
PID:1684

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8ce205027e30804d1b2deaffa0582735\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8ce205027e30804d1b2deaffa0582735\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8ce205027e30804d1b2deaffa0582735\
1⤵
PID:2652

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1492

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\b1c511d8fad78ad3c5213b2b4fb02b8b\
1⤵
PID:1108

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\
1⤵
PID:852

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2480

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\
1⤵
PID:2352

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0409\
1⤵
PID:1780

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\af058f98427f47670e70468a36d84ee4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\af058f98427f47670e70468a36d84ee4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\af058f98427f47670e70468a36d84ee4\
1⤵
PID:2224

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\
1⤵
PID:348

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\
1⤵
PID:2512

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\
1⤵
PID:1812

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\
1⤵
PID:2724

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0001\
1⤵
PID:2392

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\
1⤵
PID:2356

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2308

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\
1⤵
PID:2672

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\data.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\data.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\
1⤵
PID:1728

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\
1⤵
PID:1976
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\aa3fa7748881ce0969396eba0be3c6c3\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\aa3fa7748881ce0969396eba0be3c6c3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\aa3fa7748881ce0969396eba0be3c6c3\
  2⤵
  PID:2600
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\b5e6aa065d13e30c27219186f8e02689\
  2⤵
  PID:1100
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\update.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\
  2⤵
  PID:2872

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\
1⤵
PID:1860

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\
1⤵
PID:1536

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000B\
1⤵
PID:1088

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\
1⤵
PID:2312

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000C\
1⤵
PID:1316

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\
1⤵
PID:896

C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\
1⤵
PID:2620

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\
1⤵
PID:2600

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\
1⤵
PID:1964

C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\
1⤵
PID:2228

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0019\
1⤵
PID:1944

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:800

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:3060

C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\
1⤵
PID:1716

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1084

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0404\
1⤵
PID:1732

C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\
1⤵
PID:2832

C:\Windows\Media\Afternoon\backup.exe
C:\Windows\Media\Afternoon\backup.exe C:\Windows\Media\Afternoon\
1⤵
PID:2296

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\data.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\data.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\
1⤵
PID:2444

C:\Windows\Media\Characters\backup.exe
C:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\
1⤵
PID:2908

C:\Windows\Media\Festival\backup.exe
C:\Windows\Media\Festival\backup.exe C:\Windows\Media\Festival\
1⤵
PID:2568

C:\Windows\Media\Garden\backup.exe
C:\Windows\Media\Garden\backup.exe C:\Windows\Media\Garden\
1⤵
PID:2304

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\
1⤵
PID:296
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\c0a8f3f379d7a62a032783cc4e04a4dd\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\c0a8f3f379d7a62a032783cc4e04a4dd\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\c0a8f3f379d7a62a032783cc4e04a4dd\
  2⤵
  PID:1484

C:\Windows\Media\Raga\backup.exe
C:\Windows\Media\Raga\backup.exe C:\Windows\Media\Raga\
1⤵
PID:1036

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1828

C:\Windows\Media\Savanna\backup.exe
C:\Windows\Media\Savanna\backup.exe C:\Windows\Media\Savanna\
1⤵
PID:2320

C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\
1⤵
PID:1796

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\
1⤵
PID:2872

C:\Windows\inf\PNRPSvc\0000\backup.exe
C:\Windows\inf\PNRPSvc\0000\backup.exe C:\Windows\inf\PNRPSvc\0000\
1⤵
PID:1976

C:\Windows\Microsoft.NET\assembly\backup.exe
C:\Windows\Microsoft.NET\assembly\backup.exe C:\Windows\Microsoft.NET\assembly\
1⤵
PID:936

C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\
1⤵
PID:1588
- C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\
  2⤵
  PID:1640

C:\Windows\inf\PNRPSvc\0407\backup.exe
C:\Windows\inf\PNRPSvc\0407\backup.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:2912

C:\Windows\inf\PNRPSvc\0409\backup.exe
C:\Windows\inf\PNRPSvc\0409\backup.exe C:\Windows\inf\PNRPSvc\0409\
1⤵
PID:2288

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\
1⤵
PID:1748
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2897c35bf2bc4ef171004bfc2909aaf3\
  2⤵
  PID:1432
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\299d0b38053fd7cbd84bac2178c3703b\
  2⤵
  PID:2384

C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\
1⤵
PID:2792

C:\Windows\inf\PNRPSvc\0410\backup.exe
C:\Windows\inf\PNRPSvc\0410\backup.exe C:\Windows\inf\PNRPSvc\0410\
1⤵
PID:2688

C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1988

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2116

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2440

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1728

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\
1⤵
PID:2572

C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\update.exe C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\
1⤵
PID:1992

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2792

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\
1⤵
PID:1996
- C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
  2⤵
  PID:1772

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2068

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:756

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2416

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\
1⤵
PID:2088

C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\
1⤵
PID:2320

C:\Windows\inf\RemoteAccess\0411\System Restore.exe
"C:\Windows\inf\RemoteAccess\0411\System Restore.exe" C:\Windows\inf\RemoteAccess\0411\
1⤵
PID:2800

C:\Windows\inf\RemoteAccess\0C0A\backup.exe
C:\Windows\inf\RemoteAccess\0C0A\backup.exe C:\Windows\inf\RemoteAccess\0C0A\
1⤵
PID:1516

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:3060

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\
1⤵
PID:3052

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\update.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\update.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\
1⤵
PID:1088

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\
1⤵
PID:2040

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\
1⤵
PID:1600

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\
1⤵
PID:1492

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1808

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\
1⤵
PID:1872

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\
1⤵
PID:2864

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\
1⤵
PID:1244

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2696

C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\data.exe C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\
1⤵
PID:2276

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\
1⤵
PID:1928
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\
  2⤵
  PID:1580

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\
1⤵
PID:2516

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2992

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\
1⤵
PID:1828
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\
  2⤵
  PID:2308

C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\
1⤵
PID:960
- C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\
  2⤵
  PID:1492

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:272

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\
1⤵
PID:696
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\
  2⤵
  PID:296

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1608

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2888

C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1108

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\
1⤵
PID:2904
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\
  2⤵
  PID:2288

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\
1⤵
PID:2640

C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\
1⤵
PID:2296

C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\
1⤵
PID:272

C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\
1⤵
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3019756675\backup.exe

Filesize
122KB

MD5
769ce8597cb86bc431086a5c3b5c0948

SHA1
2bf1e4927bfddb1e2f0827514b5a538eaf8d600a

SHA256
90814308285a62bbe5020c589f492b0f37c8dc0eed112629e0e8f05234a62fd2

SHA512
e7cfb23e04a6cebb0656de38a753ae9c48b26613d9a1e2db5dcadec94c0bad2953860acdab26cb0a3e0448c23a2c11d8e391b47fc7f6e3ba0108167c8430abcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2792_1904683742\backup.exe

Filesize
122KB

MD5
8fb55f4b207f78bde270b403fbc65184

SHA1
9b67677b66050d265ccca0c97c74021709a5f1f1

SHA256
edd06497aed206b377a02797721fa261fb17ee8d7b46d183dd532af1b45eb89d

SHA512
13d9e715c922643c656b6d66e70ce25287bd3dd75feff38e5beb725fafb5bd54467dc5cbf1abc562afdcb58ee77f0d2ff5c6cde46321dfb4328258225589e2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2792_66564878\CRX_INSTALL\backup.exe

Filesize
122KB

MD5
4d1d573c10271f6ff91355c3c84b4b6f

SHA1
a7310f62a987019cfbf427c89fa86fb98c4dfe02

SHA256
2f72fe056bfa17e037feaefd0891b3042253af743a5833269936ebb8ee6d0ac8

SHA512
c6bd9eda65f292a6a4ae45d6020a0820b910bc1bb10f702eabe358dfce9aeafbbe472ceda28441b1ac46397990462d91f42d14b1b535a2f856f70c4846726dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
41KB

MD5
9145eb244f2ff5e9307c1be03ec8ae66

SHA1
15f9dd5af5e705442553964c71dc0103788b918b

SHA256
7e3d1294223f42c8477f32d2d0e964fe13d492f7060c74aee7cb72de1ced041b

SHA512
4a032181caccafac54dc75892ed5af0d2f2e54d245caf274e2e0030ecd7bada4ee3ae1350fe8c5754ea9ef28237f6221f97e8fa35deeadf8714c162c16b19d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\update.exe

Filesize
122KB

MD5
d721bc00c5b36cae992fc6b8926a0ab1

SHA1
c68399d5365bc9b6d3eff4670d7115e0c828346f

SHA256
8c65fd3d484e5d4d8e5e117e12193a84df4e5d6189e805a7f48011ed837492db

SHA512
c8e7017bc46a07c771a87a46723dded21889f9189f1d7364166fb508415acd9238034e2e5bbfd25590082cf05aeb2755a2a0d34cd0275ce39cbcad8beae9d9cb

Download Submit
\PerfLogs\Admin\update.exe

Filesize
122KB

MD5
e5bff737b1e25272f663ea61216ee056

SHA1
df97e0d9f3d84e01332e3b15f71f5c999dbada87

SHA256
145cd565ce91a7c3ff46731506af7efb2c485e140b01ab669ebc8ba765433d87

SHA512
db550bbd116bd8a334ed87e0a0edaf9a06fb049b70bd0bf9f6879c86c3acdc42137bc599b7b810ff49ce77b29b9abb9f2b4e385a4b305647ccc55a24bfa133e9

Download Submit
\PerfLogs\backup.exe

Filesize
122KB

MD5
7f318ca0f695cc8302623e7df7154576

SHA1
fb9a8532149eaca9144844df4e940d0b3446273e

SHA256
afac600097d97c16b46568ebafc2aa57766dc74d5e0d851ddf701155e8e0926b

SHA512
c88447af92e31060630d29bae51aaa2382505c2b962d06277ec3b5b26b6663d8c9054b858975f29766f45820c7c535f3ccc4ea74ec5148a4e5d013d7644e2b4b

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
e79b7e0fb6cb65d6607b83928e4ae690

SHA1
eb897bc63cef0495e054bc83ac41c4e17d306d4f

SHA256
a053aead629ef248d9090cf7cdd1176c2ea29c982d034d3f5b5a7af5d2612355

SHA512
05ccfd6eb58cc0f293e56b52eff487b765ec27748ebfdfdfce454b0e91841fd6cecc664aef42aca67c37823926f8249b373fd1095dafd92a946b35993b4b3d31

Download Submit
memory/904-240-0x0000000000360000-0x0000000000384000-memory.dmp

Filesize
144KB

Download
memory/904-232-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/936-573-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/992-302-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/996-590-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1268-326-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1328-144-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1356-266-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1356-281-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/1356-298-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1368-275-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1740-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1800-344-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1812-602-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2000-551-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2088-26-0x0000000000870000-0x0000000000894000-memory.dmp

Filesize
144KB

Download
memory/2088-141-0x0000000000870000-0x0000000000894000-memory.dmp

Filesize
144KB

Download
memory/2088-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2096-486-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2100-539-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2312-27-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2512-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-98-0x00000000003A0000-0x00000000003C4000-memory.dmp

Filesize
144KB

Download
memory/2536-352-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2560-391-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/2560-415-0x0000000000500000-0x0000000000524000-memory.dmp

Filesize
144KB

Download
memory/2560-467-0x0000000000500000-0x0000000000524000-memory.dmp

Filesize
144KB

Download
memory/2560-481-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2736-356-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2800-447-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2836-410-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2852-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2924-254-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2948-380-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/2948-517-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/2948-371-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/2968-428-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3000-403-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads