876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe
Size

122KB
MD5

697aad2dad8020da21ee5a876d14a188
SHA1

e582b518710f66fadc5e37e30be6a6a6224a3f96
SHA256

876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82
SHA512

37034c94ac2b34da559c4da504fca487b9d4314368b1928a64e615fb895cae91aa6cd40e43434b84747ca688aef71ca31c060dd5afe507bbd4893d176acc7eba
SSDEEP

1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4r:6u8ANCUdgfmD7zey0KUj6TjR9i4r

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/956-0-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-6.dat	UPX
behavioral2/memory/3700-8-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-29.dat	UPX
behavioral2/files/0x0007000000023422-71.dat	UPX
behavioral2/memory/956-72-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3700-79-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3332-85-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0008000000023423-91.dat	UPX
behavioral2/files/0x0007000000023426-100.dat	UPX
behavioral2/memory/2936-99-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0008000000023427-120.dat	UPX
behavioral2/memory/980-119-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2432-126-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0008000000023429-127.dat	UPX
behavioral2/files/0x000700000002342c-133.dat	UPX
behavioral2/files/0x0007000000023430-163.dat	UPX
behavioral2/memory/2352-178-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2928-183-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0008000000023434-186.dat	UPX
behavioral2/memory/3424-194-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4580-219-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x0008000000023438-226.dat	UPX
behavioral2/memory/2308-234-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1536-254-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2476-277-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1308-272-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4932-267-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4328-261-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1804-250-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4172-246-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3308-240-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1052-294-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4876-299-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4780-309-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3556-327-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3492-368-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1076-385-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3384-395-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4888-400-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/396-411-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4776-429-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3256-433-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4288-448-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4332-453-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3040-458-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1940-463-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2168-476-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3824-482-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2864-503-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2864-506-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/5020-518-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4948-524-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4780-540-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3492-557-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/1228-563-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2852-569-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/4440-582-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3928-601-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2448-607-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3476-650-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/600-656-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/3788-661-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/5100-674-0x0000000000400000-0x0000000000424000-memory.dmp	UPX

C:\Users\Admin\AppData\Local\Temp\876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe
"C:\Users\Admin\AppData\Local\Temp\876f3392b15d77756cf0e8c854be9f2ae9d7c260e0de58267a30b48fd4d6ba82.exe"
1⤵
PID:956
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:4412

C:\PerfLogs\update.exe
C:\PerfLogs\update.exe C:\PerfLogs\
1⤵
PID:980

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
1⤵
PID:552

C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
"C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
1⤵
PID:1428

C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
1⤵
PID:1536

C:\Program Files\Common Files\microsoft shared\ink\et-EE\update.exe
"C:\Program Files\Common Files\microsoft shared\ink\et-EE\update.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
1⤵
PID:4328

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
1⤵
PID:4932

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
1⤵
PID:1308

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:2476

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\System Restore.exe
"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
1⤵
PID:2336
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:1052
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
  2⤵
  PID:1912
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
  2⤵
  PID:4780
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
  2⤵
  PID:3556
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
  2⤵
  PID:3592

C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
1⤵
PID:2380

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
1⤵
PID:4552

C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
1⤵
PID:3492

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
1⤵
PID:3416

C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
1⤵
PID:1076

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
1⤵
PID:3384

C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
1⤵
PID:396

C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
1⤵
PID:3092

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
1⤵
PID:4776

C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
1⤵
PID:4676

C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
1⤵
PID:4288

C:\Program Files\Common Files\microsoft shared\ink\sv-SE\data.exe
"C:\Program Files\Common Files\microsoft shared\ink\sv-SE\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
1⤵
PID:3040

C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
1⤵
PID:1940

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
1⤵
PID:116

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
1⤵
PID:2168

C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
1⤵
PID:1296

C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
1⤵
PID:5020

C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe
"C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\
1⤵
PID:4972

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
1⤵
PID:2272

C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe
"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
1⤵
PID:1260

C:\Program Files\Common Files\microsoft shared\VC\backup.exe
"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
1⤵
PID:3928

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
1⤵
PID:380

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:1596

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:1452
- C:\Program Files\Common Files\System\ado\data.exe
  "C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:788
- - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
    3⤵
    PID:3476
- - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
    3⤵
    PID:4396
- C:\Program Files\Common Files\System\en-US\backup.exe
  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:1388
- C:\Program Files\Common Files\System\es-ES\backup.exe
  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
  2⤵
  PID:4464

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:2736

C:\Program Files\Common Files\System\msadc\es-ES\data.exe
"C:\Program Files\Common Files\System\msadc\es-ES\data.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:1988

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:3244

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:4244

C:\Program Files\dotnet\backup.exe
"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\
1⤵
PID:380
- C:\Program Files\dotnet\host\backup.exe
  "C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\
  2⤵
  PID:3688
- - C:\Program Files\dotnet\host\fxr\backup.exe
    "C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\
    3⤵
    PID:3840
  - - C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe
      "C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.27\
      4⤵
      PID:4600
  - - C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe
      "C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe" C:\Program Files\dotnet\host\fxr\7.0.16\
      4⤵
      PID:4344
- C:\Program Files\dotnet\shared\backup.exe
  "C:\Program Files\dotnet\shared\backup.exe" C:\Program Files\dotnet\shared\
  2⤵
  PID:3788
- - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\
    3⤵
    PID:2168
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\
      4⤵
      PID:3824
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\
      4⤵
      PID:788
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\
      4⤵
      PID:1136
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\
    3⤵
    PID:4848
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\
      4⤵
      PID:3536
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\
        5⤵
        
        PID:2588
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\
        5⤵
        
        PID:1728
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\
        5⤵
        
        PID:3088
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\
        5⤵
        
        PID:1804
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\
        5⤵
        
        PID:60
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\
        5⤵
        
        PID:4356
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\
        5⤵
        
        PID:4060
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\
        5⤵
        
        PID:5060
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\
        5⤵
        
        PID:4812

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\
1⤵
PID:2636

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\
1⤵
PID:3720

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\
1⤵
PID:4488

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\
1⤵
PID:1068

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\update.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\
1⤵
PID:2864

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\
1⤵
PID:4408

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\
1⤵
PID:4784

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\
1⤵
PID:3784

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\
1⤵
PID:4052

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\
1⤵
PID:3068

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\
1⤵
PID:3224

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:752
- C:\Program Files\Google\Chrome\Application\backup.exe
  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
  2⤵
  PID:2708
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\
    3⤵
    PID:1452
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\
      4⤵
      PID:492
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\
      4⤵
      PID:4488
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\
      4⤵
      PID:2456
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\backup.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\
      4⤵
      PID:2672

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:3392
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:2908
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
    3⤵
    PID:2368
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
      4⤵
      PID:3188
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
        5⤵
        
        PID:1296
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
        6⤵
        
        PID:1572
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
        5⤵
        
        PID:1964
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
        5⤵
        
        PID:2988
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
        6⤵
        
        PID:2212
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
        5⤵
        
        PID:2676
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
        6⤵
        
        PID:1800
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
        7⤵
        
        PID:1516
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
        6⤵
        
        PID:968
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
        5⤵
        
        PID:1388
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
      4⤵
      PID:1296
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
        5⤵
        
        PID:4328
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
        6⤵
        
        PID:4476
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
        7⤵
        
        PID:672
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
        8⤵
        
        PID:4552
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:4544
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:4048
- - C:\Program Files (x86)\Internet Explorer\images\backup.exe
    "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
    3⤵
    PID:3576
- - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
    "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
    3⤵
    PID:2588
- - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
    "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
    3⤵
    PID:2272
- - C:\Program Files (x86)\Internet Explorer\uk-UA\data.exe
    "C:\Program Files (x86)\Internet Explorer\uk-UA\data.exe" C:\Program Files (x86)\Internet Explorer\uk-UA\
    3⤵
    PID:2128
- C:\Program Files (x86)\Windows Defender\backup.exe
  "C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\
  2⤵
  PID:3828
- - C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
    "C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
    3⤵
    PID:4012
- - C:\Program Files (x86)\Windows Defender\it-IT\backup.exe
    "C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\
    3⤵
    PID:2764
- - C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
    "C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
    3⤵
    PID:32
- - C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe
    "C:\Program Files (x86)\Windows Defender\uk-UA\backup.exe" C:\Program Files (x86)\Windows Defender\uk-UA\
    3⤵
    PID:4344
- C:\Program Files (x86)\Windows Mail\backup.exe
  "C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\
  2⤵
  PID:1816
- C:\Program Files (x86)\Windows Media Player\backup.exe
  "C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\
  2⤵
  PID:5084
- - C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe
    "C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
    3⤵
    PID:768
- - C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
    "C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
    3⤵
    PID:4892
- - C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe
    "C:\Program Files (x86)\Windows Media Player\it-IT\backup.exe" C:\Program Files (x86)\Windows Media Player\it-IT\
    3⤵
    PID:2464
- - C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe
    "C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\
    3⤵
    PID:1728
- C:\Program Files (x86)\Windows NT\backup.exe
  "C:\Program Files (x86)\Windows NT\backup.exe" C:\Program Files (x86)\Windows NT\
  2⤵
  PID:3396
- C:\Program Files (x86)\WindowsPowerShell\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\backup.exe" C:\Program Files (x86)\WindowsPowerShell\
  2⤵
  PID:4948

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:1900

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2552
- C:\Program Files\Internet Explorer\de-DE\backup.exe
  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
  2⤵
  PID:4060
- C:\Program Files\Internet Explorer\SIGNUP\backup.exe
  "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
  2⤵
  PID:3228
- C:\Program Files\Internet Explorer\uk-UA\backup.exe
  "C:\Program Files\Internet Explorer\uk-UA\backup.exe" C:\Program Files\Internet Explorer\uk-UA\
  2⤵
  PID:3840

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
1⤵
PID:4052

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
1⤵
PID:2272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
1⤵
PID:4328

C:\Program Files\Java\jdk-1.8\bin\backup.exe
"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
1⤵
PID:3080

C:\Program Files\Java\jdk-1.8\include\win32\backup.exe
"C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\
1⤵
PID:2708

C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\
1⤵
PID:2196
- C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
  2⤵
  PID:4336

C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\
1⤵
PID:3508

C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\
1⤵
PID:428

C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
1⤵
PID:4708

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
1⤵
PID:1516

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\
1⤵
PID:4536

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
1⤵
PID:2892

C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\
1⤵
PID:1068

C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\
1⤵
PID:4168
- C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\
  2⤵
  PID:5100
- - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\
    3⤵
    PID:384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\
1⤵
PID:788
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
  2⤵
  PID:1388

C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe
"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\
1⤵
PID:4468

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
1⤵
PID:3308
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
  2⤵
  PID:2156
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\
  2⤵
  PID:1964
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
    3⤵
    PID:2276

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\
1⤵
PID:408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\
1⤵
PID:4132

C:\Program Files\Java\jre-1.8\legal\backup.exe
"C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\
1⤵
PID:4908
- C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe
  "C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
  2⤵
  PID:672

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\
1⤵
PID:3828

C:\Program Files\Java\jre-1.8\lib\applet\backup.exe
"C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\
1⤵
PID:1452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\
1⤵
PID:1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\
1⤵
PID:2460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\
1⤵
PID:1404

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\
1⤵
PID:3556

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\
1⤵
PID:3040

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
1⤵
PID:4816

C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
"C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
1⤵
PID:1388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\
1⤵
PID:936

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\
1⤵
PID:4696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\
1⤵
PID:3952
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\
  2⤵
  PID:3508

C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\
1⤵
PID:2800

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\
1⤵
PID:4156

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\
1⤵
PID:3064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\
1⤵
PID:1816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\
1⤵
PID:2448

C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\
1⤵
PID:2800

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\
1⤵
PID:4132

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\update.exe
"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\update.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\
1⤵
PID:4860

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\
1⤵
PID:4868

C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\
1⤵
PID:3900

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\
1⤵
PID:2012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\
1⤵
PID:4848

C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f7\
1⤵
PID:4496

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\
1⤵
PID:3464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\
1⤵
PID:3092

C:\Program Files\Microsoft Office\root\Office16\FPA_w1\System Restore.exe
"C:\Program Files\Microsoft Office\root\Office16\FPA_w1\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_w1\
1⤵
PID:3824

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\
1⤵
PID:2752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\
1⤵
PID:2212

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\
1⤵
PID:3068

C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\
1⤵
PID:3384
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\
  2⤵
  PID:2864
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\
  2⤵
  PID:3224
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\
  2⤵
  PID:2208
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\
  2⤵
  PID:3532
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\
  2⤵
  PID:4664
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\
  2⤵
  PID:3532
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\
  2⤵
  PID:4680
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\
  2⤵
  PID:1664
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\
  2⤵
  PID:4496
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\
  2⤵
  PID:4916
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\
  2⤵
  PID:4776
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\
  2⤵
  PID:3092
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\
  2⤵
  PID:4132
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\
  2⤵
  PID:4304
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\
  2⤵
  PID:4616
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\
  2⤵
  PID:4680
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\
  2⤵
  PID:4868
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\
  2⤵
  PID:5096
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\
  2⤵
  PID:3720
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\
  2⤵
  PID:4012
- C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\
  2⤵
  PID:1836

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\
1⤵
PID:1288

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\
1⤵
PID:2764

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:2332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\
1⤵
PID:384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\
1⤵
PID:4388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\
1⤵
PID:3492

C:\Users\Admin\Music\update.exe
C:\Users\Admin\Music\update.exe C:\Users\Admin\Music\
1⤵
PID:4168

C:\Users\Admin\OneDrive\backup.exe
C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
1⤵
PID:3240

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
1⤵
PID:5068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\
1⤵
PID:3840

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
1⤵
PID:1044
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
  2⤵
  PID:428
- - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
    3⤵
    PID:2232

C:\Users\Admin\Pictures\Camera Roll\backup.exe
"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
1⤵
PID:3228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\
1⤵
PID:4036

C:\Users\Admin\Pictures\Saved Pictures\backup.exe
"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
1⤵
PID:1904

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\
1⤵
PID:4044

C:\Users\Public\Music\backup.exe
C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
1⤵
PID:3112

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\
1⤵
PID:5008

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\
1⤵
PID:4608

C:\Users\Public\Videos\backup.exe
C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
1⤵
PID:4964

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
1⤵
PID:4388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\
1⤵
PID:3732

C:\Program Files (x86)\Common Files\Java\backup.exe
"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
1⤵
PID:3004
- C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
  "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
  2⤵
  PID:4736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\
1⤵
PID:2932

C:\Windows\appcompat\appraiser\Telemetry\backup.exe
C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
1⤵
PID:2624

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\
1⤵
PID:1444
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\
  2⤵
  PID:3092
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\
  2⤵
  PID:3868

C:\Windows\appcompat\encapsulation\System Restore.exe
"C:\Windows\appcompat\encapsulation\System Restore.exe" C:\Windows\appcompat\encapsulation\
1⤵
PID:1940

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
1⤵
PID:5116

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\
1⤵
PID:2716
- C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\
  2⤵
  PID:3984
- C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\
  2⤵
  PID:3192

C:\Windows\appcompat\Programs\backup.exe
C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
1⤵
PID:1332

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
1⤵
PID:5096

C:\Windows\apppatch\AppPatch64\backup.exe
C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
1⤵
PID:1392

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:2208

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\
1⤵
PID:1400

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\
1⤵
PID:1012
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\
  2⤵
  PID:2676
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\
  2⤵
  PID:1288
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\
  2⤵
  PID:4376
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\
  2⤵
  PID:3224
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\
  2⤵
  PID:3712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\
  2⤵
  PID:3592
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\
  2⤵
  PID:1516
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\
  2⤵
  PID:1224
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\
  2⤵
  PID:3236
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\
  2⤵
  PID:4664
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\
  2⤵
  PID:3720
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\
  2⤵
  PID:2968
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\
  2⤵
  PID:768

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\
1⤵
PID:4572

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\
1⤵
PID:2064

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe
"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\46EE467C-2874-4C58-A7D4-CDA60D9871B1\
1⤵
PID:4540

C:\Windows\apppatch\it-IT\backup.exe
C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
1⤵
PID:2448

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:4332

C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\osfFPA\
1⤵
PID:440

C:\Windows\apppatch\ja-JP\backup.exe
C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
1⤵
PID:3448

C:\Windows\AppReadiness\backup.exe
C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
1⤵
PID:2800

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\
1⤵
PID:2672

C:\Program Files\Mozilla Firefox\defaults\pref\data.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\data.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:5052

C:\Program Files\Microsoft Office\root\Templates\backup.exe
"C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\
1⤵
PID:3904
- C:\Program Files\Microsoft Office\root\Templates\1033\update.exe
  "C:\Program Files\Microsoft Office\root\Templates\1033\update.exe" C:\Program Files\Microsoft Office\root\Templates\1033\
  2⤵
  PID:536

C:\Program Files\Mozilla Firefox\fonts\backup.exe
"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
1⤵
PID:2460

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\
1⤵
PID:3484
- C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\update.exe
  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\update.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\
  2⤵
  PID:1476

C:\Program Files\Microsoft Office\root\Office16\QUERIES\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\QUERIES\backup.exe" C:\Program Files\Microsoft Office\root\Office16\QUERIES\
1⤵
PID:3080

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
1⤵
PID:1592
- C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\update.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\update.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
  2⤵
  PID:440

C:\Windows\assembly\GAC\ADODB\update.exe
C:\Windows\assembly\GAC\ADODB\update.exe C:\Windows\assembly\GAC\ADODB\
1⤵
PID:1596

C:\Program Files\Microsoft Office\root\Office16\SAMPLES\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\SAMPLES\backup.exe" C:\Program Files\Microsoft Office\root\Office16\SAMPLES\
1⤵
PID:3288

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
1⤵
PID:1960

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:3724
- C:\Program Files\MSBuild\Microsoft\backup.exe
  "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
  2⤵
  PID:64
- - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
    "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
    3⤵
    PID:5076
  - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
      "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
      4⤵
      PID:4480

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
1⤵
PID:4112
- C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe
  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\46EE467C-2874-4C58-A7D4-CDA60D9871B1\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\
  2⤵
  PID:4800

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\
1⤵
PID:1400
- C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\
  2⤵
  PID:2448

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2460
- C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:2928

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2184

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe
"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\
1⤵
PID:3004

C:\Program Files\Microsoft Office\root\vfs\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\backup.exe" C:\Program Files\Microsoft Office\root\vfs\
1⤵
PID:4552
- C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\
  2⤵
  PID:4020
- - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\
    3⤵
    PID:4136
- - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\
    3⤵
    PID:2520
- C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\
  2⤵
  PID:3592
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System Restore.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\
  2⤵
  PID:572
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\
    3⤵
    PID:4540
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\
      4⤵
      PID:216
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\
      4⤵
      PID:2848
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\
      4⤵
      PID:732
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\
      4⤵
      PID:2676
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\System Restore.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\
      4⤵
      PID:3236
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\
        5⤵
        
        PID:4012
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\
        5⤵
        
        PID:1964
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\
        6⤵
        
        PID:2764
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\update.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\
      4⤵
      PID:3556
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\
      4⤵
      PID:2980
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\
        5⤵
        
        PID:2520
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\
        5⤵
        
        PID:540
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\
        5⤵
        
        PID:2076
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\
        5⤵
        
        PID:4816
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\
        5⤵
        
        PID:5076
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\
        5⤵
        
        PID:2900
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\
        5⤵
        
        PID:3492
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\
        5⤵
        
        PID:1532
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\
        5⤵
        
        PID:5116
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\
        5⤵
        
        PID:2916
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\
        5⤵
        
        PID:1728
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\
        5⤵
        
        PID:3880
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\
        5⤵
        
        PID:4288
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\
        5⤵
        
        PID:3132
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\
        5⤵
        
        PID:4012
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\
        5⤵
        
        PID:1532
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\
        5⤵
        
        PID:4596
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\
        5⤵
        
        PID:4468
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\data.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\
        5⤵
        
        PID:3912
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\
        5⤵
        
        PID:388
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\
        5⤵
        
        PID:2104
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\
        5⤵
        
        PID:60
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\
      4⤵
      PID:3272
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\
        5⤵
        
        PID:3320
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\
        5⤵
        
        PID:1548
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\
      4⤵
      PID:5020
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\
    3⤵
    PID:672
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\
  2⤵
  PID:1764
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\
    3⤵
    PID:2588
- C:\Program Files\Microsoft Office\root\vfs\System\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\System\backup.exe" C:\Program Files\Microsoft Office\root\vfs\System\
  2⤵
  PID:4776

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\
1⤵
PID:672

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\
1⤵
PID:1404

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:1764

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:3228
- C:\Program Files\Reference Assemblies\Microsoft\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
  2⤵
  PID:2932

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:1728
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
  2⤵
  PID:4924
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
  2⤵
  PID:4060

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\
1⤵
PID:3708

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\
1⤵
PID:4132

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:732

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\
1⤵
PID:968
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
  2⤵
  PID:1824
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\
  2⤵
  PID:5008

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\
1⤵
PID:4440

C:\Windows\assembly\GAC\MSDATASRC\backup.exe
C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\
1⤵
PID:388

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\
1⤵
PID:4596

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\
1⤵
PID:3380

C:\Program Files\Microsoft Office\root\Office16\STARTUP\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\STARTUP\backup.exe" C:\Program Files\Microsoft Office\root\Office16\STARTUP\
1⤵
PID:2900

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:2272

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\data.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
1⤵
PID:4592

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2784

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\
1⤵
PID:968

C:\Program Files (x86)\Common Files\Services\backup.exe
"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:4500

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2336

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
1⤵
PID:4408

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:4532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\
1⤵
PID:2448
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\
  2⤵
  PID:1884
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\
  2⤵
  PID:1068

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
1⤵
PID:4572

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
1⤵
PID:756

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:4536
- C:\Program Files\VideoLAN\VLC\backup.exe
  "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
  2⤵
  PID:3224
- - C:\Program Files\VideoLAN\VLC\plugins\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
    3⤵
    PID:3868
  - - C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
      4⤵
      PID:2376
  - - C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
      4⤵
      PID:3080
  - - C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
      4⤵
      PID:3448
  - - C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\mux\
      4⤵
      PID:2288
  - - C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_filter\
      4⤵
      PID:4880
  - - C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\text_renderer\
      4⤵
      PID:3496
  - - C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_chroma\
      4⤵
      PID:3396
  - - C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
      4⤵
      PID:2336
  - - C:\Program Files\VideoLAN\VLC\plugins\visualization\System Restore.exe
      "C:\Program Files\VideoLAN\VLC\plugins\visualization\System Restore.exe" C:\Program Files\VideoLAN\VLC\plugins\visualization\
      4⤵
      PID:4664

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\
1⤵
PID:2276

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
1⤵
PID:4036

C:\Program Files (x86)\Google\Update\Install\backup.exe
"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
1⤵
PID:3880
- C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\backup.exe
  "C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\
  2⤵
  PID:1728

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\
1⤵
PID:2816

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
1⤵
PID:2380

C:\Program Files\VideoLAN\VLC\locale\ach\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
1⤵
PID:4736

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
1⤵
PID:3256

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\
1⤵
PID:4032

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1012

C:\Windows\assembly\GAC_32\MSBuild\data.exe
C:\Windows\assembly\GAC_32\MSBuild\data.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:2940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\
1⤵
PID:1136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\
1⤵
PID:5076

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
1⤵
PID:32

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
1⤵
PID:1596

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\
1⤵
PID:2184

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
1⤵
PID:856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\
1⤵
PID:4920

C:\Program Files (x86)\Common Files\System\msadc\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
1⤵
PID:3964
- C:\Program Files (x86)\Common Files\System\msadc\en-US\update.exe
  "C:\Program Files (x86)\Common Files\System\msadc\en-US\update.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
  2⤵
  PID:3396
- C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\
  2⤵
  PID:1596
- C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
  2⤵
  PID:556
- C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\
  2⤵
  PID:4904

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\System Restore.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\
1⤵
PID:2460

C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\
1⤵
PID:4736

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
1⤵
PID:2168
- C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
  2⤵
  PID:1476

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
1⤵
PID:5000

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\
1⤵
PID:3380

C:\Windows\assembly\GAC_32\System.Data\data.exe
C:\Windows\assembly\GAC_32\System.Data\data.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:4388
- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\
1⤵
PID:3080

C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
1⤵
PID:4112

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\
1⤵
PID:768

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:3680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\
1⤵
PID:4680

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\
1⤵
PID:732
- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\
1⤵
PID:3484

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:60

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:3184

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\
1⤵
PID:4856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\
1⤵
PID:1864

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\
1⤵
PID:2848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\
1⤵
PID:4508

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
1⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
1⤵
PID:3228

C:\Windows\assembly\GAC_32\System.Web\backup.exe
C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\
1⤵
PID:1228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\
1⤵
PID:2864

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\
1⤵
PID:5084

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3572

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
1⤵
PID:5000

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\update.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\update.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\
1⤵
PID:3184

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\
1⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\
1⤵
PID:768

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\
1⤵
PID:2916

C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
1⤵
PID:4972

C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe
"C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\System\uk-UA\
1⤵
PID:4544

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2456

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
1⤵
PID:3076

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
1⤵
PID:4964
- C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:3804

C:\Windows\bcastdvr\backup.exe
C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
1⤵
PID:2928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\
1⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\
1⤵
PID:4336

C:\Windows\Branding\Basebrd\de-DE\backup.exe
C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\
1⤵
PID:1136

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:4812
- C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:116

C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
1⤵
PID:3448
- C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
  2⤵
  PID:600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\
1⤵
PID:716

C:\Windows\Branding\Basebrd\en-US\backup.exe
C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
1⤵
PID:1664

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\
1⤵
PID:4028

C:\Windows\assembly\GAC_64\MSBuild\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\
1⤵
PID:4952
- C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\data.exe
  C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\
1⤵
PID:4544

C:\Program Files\VideoLAN\VLC\locale\ca@valencia\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\
1⤵
PID:216
- C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\
  2⤵
  PID:3464

C:\Windows\assembly\GAC_64\mscorlib\backup.exe
C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\
1⤵
PID:1056
- C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:4972

C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
1⤵
PID:3112

C:\Windows\Branding\Basebrd\uk-UA\data.exe
C:\Windows\Branding\Basebrd\uk-UA\data.exe C:\Windows\Branding\Basebrd\uk-UA\
1⤵
PID:1404

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\
1⤵
PID:4476

C:\Windows\Branding\shellbrd\backup.exe
C:\Windows\Branding\shellbrd\backup.exe C:\Windows\Branding\shellbrd\
1⤵
PID:600

C:\Windows\CbsTemp\backup.exe
C:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\
1⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\
1⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\
1⤵
PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\
  2⤵
  PID:3708

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\
1⤵
PID:4352

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\
1⤵
PID:860
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\
  2⤵
  PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\
1⤵
PID:2968

C:\Windows\de-DE\backup.exe
C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
1⤵
PID:4848

C:\Windows\DiagTrack\backup.exe
C:\Windows\DiagTrack\backup.exe C:\Windows\DiagTrack\
1⤵
PID:2044
- C:\Windows\DiagTrack\Settings\backup.exe
  C:\Windows\DiagTrack\Settings\backup.exe C:\Windows\DiagTrack\Settings\
  2⤵
  PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\
1⤵
PID:2076

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\
1⤵
PID:4676

C:\Windows\DigitalLocker\backup.exe
C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
1⤵
PID:1316

C:\Windows\assembly\GAC_64\System.Transactions\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\
1⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\
1⤵
PID:4980

C:\Windows\assembly\GAC_64\System.Web\backup.exe
C:\Windows\assembly\GAC_64\System.Web\backup.exe C:\Windows\assembly\GAC_64\System.Web\
1⤵
PID:4816

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\
1⤵
PID:4836

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\
1⤵
PID:2128

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\
1⤵
PID:3984

C:\Windows\es-ES\update.exe
C:\Windows\es-ES\update.exe C:\Windows\es-ES\
1⤵
PID:3592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\
1⤵
PID:3228

C:\Windows\fr-FR\backup.exe
C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\
1⤵
PID:4920

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:5000

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\
1⤵
PID:3416

C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
1⤵
PID:1728

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\
1⤵
PID:1904

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\
1⤵
PID:3428

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:3904

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\
1⤵
PID:2948

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\
1⤵
PID:4944

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\update.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\update.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\
1⤵
PID:3112

C:\Windows\Globalization\ELS\Transliteration\System Restore.exe
"C:\Windows\Globalization\ELS\Transliteration\System Restore.exe" C:\Windows\Globalization\ELS\Transliteration\
1⤵
PID:4788

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\
1⤵
PID:3296

C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
1⤵
PID:216

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\
1⤵
PID:572

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4200

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:3236

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1332

C:\Windows\Help\Help\backup.exe
C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
1⤵
PID:3328

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:3288

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
1⤵
PID:4876

C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
1⤵
PID:2648

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\
1⤵
PID:4784

C:\Windows\Help\mui\backup.exe
C:\Windows\Help\mui\backup.exe C:\Windows\Help\mui\
1⤵
PID:3448
- C:\Windows\Help\mui\040C\backup.exe
  C:\Windows\Help\mui\040C\backup.exe C:\Windows\Help\mui\040C\
  2⤵
  PID:2480
- C:\Windows\Help\mui\0411\backup.exe
  C:\Windows\Help\mui\0411\backup.exe C:\Windows\Help\mui\0411\
  2⤵
  PID:4612

C:\Windows\assembly\GAC_MSIL\cscompmgd\data.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\data.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
1⤵
PID:2440
- C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2272

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:4816

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\
1⤵
PID:1012

C:\Program Files\Windows Media Player\fr-FR\backup.exe
"C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:3380

C:\Program Files\Windows Media Player\it-IT\backup.exe
"C:\Program Files\Windows Media Player\it-IT\backup.exe" C:\Program Files\Windows Media Player\it-IT\
1⤵
PID:4868

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2308

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\
1⤵
PID:4284
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\
  2⤵
  PID:3192

C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
1⤵
PID:4052

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:4500
- C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
  2⤵
  PID:2436
- - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
    "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
    3⤵
    PID:4708

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\
1⤵
PID:1068

C:\Program Files\Windows Media Player\ja-JP\backup.exe
"C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
1⤵
PID:3712

C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
1⤵
PID:2332

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\
1⤵
PID:1444

C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe
C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\
1⤵
PID:4928

C:\Program Files\VideoLAN\VLC\lua\modules\System Restore.exe
"C:\Program Files\VideoLAN\VLC\lua\modules\System Restore.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
1⤵
PID:2588

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\
1⤵
PID:4608
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\
  2⤵
  PID:3580

C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\
1⤵
PID:4964

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\
1⤵
PID:380

C:\Program Files\Windows Media Player\uk-UA\backup.exe
"C:\Program Files\Windows Media Player\uk-UA\backup.exe" C:\Program Files\Windows Media Player\uk-UA\
1⤵
PID:2428

C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\
1⤵
PID:4780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\
1⤵
PID:3788

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\
1⤵
PID:4396

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:3272

C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
1⤵
PID:4612

C:\Windows\Help\OEM\IndexStore\backup.exe
C:\Windows\Help\OEM\IndexStore\backup.exe C:\Windows\Help\OEM\IndexStore\
1⤵
PID:1900

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\
1⤵
PID:2916

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:4204

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\
1⤵
PID:1676

C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
1⤵
PID:1764

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:2432

C:\Windows\Help\Windows\IndexStore\backup.exe
C:\Windows\Help\Windows\IndexStore\backup.exe C:\Windows\Help\Windows\IndexStore\
1⤵
PID:4332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\
1⤵
PID:3676

C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
1⤵
PID:3732

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:5072

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
1⤵
PID:4596

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:3192
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:5116
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:1388

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:4856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\
1⤵
PID:1016

C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
1⤵
PID:1972

C:\Program Files\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files\Windows Photo Viewer\it-IT\
1⤵
PID:5052

C:\Windows\IME\en-US\update.exe
C:\Windows\IME\en-US\update.exe C:\Windows\IME\en-US\
1⤵
PID:768

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\
1⤵
PID:4196

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:4140

C:\Windows\IME\IMEJP\Assets\backup.exe
C:\Windows\IME\IMEJP\Assets\backup.exe C:\Windows\IME\IMEJP\Assets\
1⤵
PID:4352

C:\Program Files\Windows Security\update.exe
"C:\Program Files\Windows Security\update.exe" C:\Program Files\Windows Security\
1⤵
PID:3148

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\
1⤵
PID:2816

C:\Windows\IME\IMEJP\DICTS\backup.exe
C:\Windows\IME\IMEJP\DICTS\backup.exe C:\Windows\IME\IMEJP\DICTS\
1⤵
PID:1068

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2944

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4536

C:\Windows\IME\IMEKR\backup.exe
C:\Windows\IME\IMEKR\backup.exe C:\Windows\IME\IMEKR\
1⤵
PID:1436
- C:\Windows\IME\IMEKR\HELP\backup.exe
  C:\Windows\IME\IMEKR\HELP\backup.exe C:\Windows\IME\IMEKR\HELP\
  2⤵
  PID:3576

C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
1⤵
PID:1592
- C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
  2⤵
  PID:1332

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\
1⤵
PID:4916

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\
1⤵
PID:1324
- C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\
  2⤵
  PID:5020
- - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\
    3⤵
    PID:2760
  - - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\
      4⤵
      PID:1392

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4196

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\
1⤵
PID:4856

C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ie\
1⤵
PID:1468
- C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\
  2⤵
  PID:2752

C:\Windows\IME\IMETC\backup.exe
C:\Windows\IME\IMETC\backup.exe C:\Windows\IME\IMETC\
1⤵
PID:2712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\
1⤵
PID:3288

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\
1⤵
PID:3952

C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
1⤵
PID:4540

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\
1⤵
PID:1056

C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
1⤵
PID:4512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\
1⤵
PID:2908

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\
1⤵
PID:3456

C:\Windows\IME\it-IT\backup.exe
C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
1⤵
PID:4544

C:\Windows\IME\ja-JP\update.exe
C:\Windows\IME\ja-JP\update.exe C:\Windows\IME\ja-JP\
1⤵
PID:2588

C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
1⤵
PID:1404

C:\Windows\ImmersiveControlPanel\backup.exe
C:\Windows\ImmersiveControlPanel\backup.exe C:\Windows\ImmersiveControlPanel\
1⤵
PID:3236
- C:\Windows\ImmersiveControlPanel\images\backup.exe
  C:\Windows\ImmersiveControlPanel\images\backup.exe C:\Windows\ImmersiveControlPanel\images\
  2⤵
  PID:3984
- C:\Windows\ImmersiveControlPanel\SystemSettings\backup.exe
  C:\Windows\ImmersiveControlPanel\SystemSettings\backup.exe C:\Windows\ImmersiveControlPanel\SystemSettings\
  2⤵
  PID:3900
- - C:\Windows\ImmersiveControlPanel\SystemSettings\View\backup.exe
    C:\Windows\ImmersiveControlPanel\SystemSettings\View\backup.exe C:\Windows\ImmersiveControlPanel\SystemSettings\View\
    3⤵
    PID:4912

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
1⤵
PID:2900

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\
1⤵
PID:3416

C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
1⤵
PID:3080

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\
1⤵
PID:3868

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:3952

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\
1⤵
PID:2676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\
1⤵
PID:2432

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\
1⤵
PID:2944

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:968

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\
1⤵
PID:1044

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:3416

C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
1⤵
PID:3244

C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\
1⤵
PID:4480

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
1⤵
PID:752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\
1⤵
PID:2460
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\
  2⤵
  PID:5076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\
    3⤵
    PID:4256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\System Restore.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\
    3⤵
    PID:924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\
    3⤵
    PID:3148
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\
    3⤵
    PID:972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\
    3⤵
    PID:2932
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\
    3⤵
    PID:768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\
    3⤵
    PID:5032
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\
    3⤵
    PID:384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\
    3⤵
    PID:3676
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\
    3⤵
    PID:4156

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:536

C:\Windows\INF\BITS\0000\backup.exe
C:\Windows\INF\BITS\0000\backup.exe C:\Windows\INF\BITS\0000\
1⤵
PID:2064

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:4468

C:\Windows\INF\BITS\0407\backup.exe
C:\Windows\INF\BITS\0407\backup.exe C:\Windows\INF\BITS\0407\
1⤵
PID:2232

C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\
1⤵
PID:1896

C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
1⤵
PID:2900

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\
1⤵
PID:4920

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\
1⤵
PID:4048

C:\Windows\INF\BITS\0409\backup.exe
C:\Windows\INF\BITS\0409\backup.exe C:\Windows\INF\BITS\0409\
1⤵
PID:2784

C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\
1⤵
PID:4060

C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\
1⤵
PID:4812

C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\
1⤵
PID:4444
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\
  2⤵
  PID:860
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\
    3⤵
    PID:4876
- C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\
  2⤵
  PID:116
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\
  2⤵
  PID:3092

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:2308

C:\Program Files\VideoLAN\VLC\locale\ku_IQ\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ku_IQ\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ku_IQ\
1⤵
PID:1044
- C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\
  2⤵
  PID:4908

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4108

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\
1⤵
PID:2040

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2900

C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
1⤵
PID:1056

C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
1⤵
PID:4288

C:\Windows\INF\ESENT\backup.exe
C:\Windows\INF\ESENT\backup.exe C:\Windows\INF\ESENT\
1⤵
PID:4964
- C:\Windows\INF\ESENT\0410\data.exe
  C:\Windows\INF\ESENT\0410\data.exe C:\Windows\INF\ESENT\0410\
  2⤵
  PID:2436
- C:\Windows\INF\ESENT\0411\backup.exe
  C:\Windows\INF\ESENT\0411\backup.exe C:\Windows\INF\ESENT\0411\
  2⤵
  PID:3228

C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
1⤵
PID:3284
- C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
  2⤵
  PID:4972

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:4928

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\
1⤵
PID:4512

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\
1⤵
PID:972

C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\
1⤵
PID:3572

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\
1⤵
PID:5024

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:4680

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\update.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\update.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\
1⤵
PID:2536

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:792

C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
1⤵
PID:4748

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:552

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\
1⤵
PID:492

C:\Windows\INF\LSM\backup.exe
C:\Windows\INF\LSM\backup.exe C:\Windows\INF\LSM\
1⤵
PID:1068

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\
1⤵
PID:1960

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:3396

C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
1⤵
PID:4860

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\
1⤵
PID:1632

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\
1⤵
PID:5084

C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
1⤵
PID:4812
- C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
  2⤵
  PID:3616

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\
1⤵
PID:3040
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\
  2⤵
  PID:4332
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2488

C:\Windows\INF\MSDTC\0000\backup.exe
C:\Windows\INF\MSDTC\0000\backup.exe C:\Windows\INF\MSDTC\0000\
1⤵
PID:2480

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\
1⤵
PID:3592

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\
1⤵
PID:1312

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
1⤵
PID:4032
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\data.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\
  2⤵
  PID:4552

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
1⤵
PID:4912

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
1⤵
PID:4236

C:\Windows\INF\MSDTC\0410\backup.exe
C:\Windows\INF\MSDTC\0410\backup.exe C:\Windows\INF\MSDTC\0410\
1⤵
PID:2752

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\
1⤵
PID:1288
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\
  2⤵
  PID:4784

C:\Windows\INF\MSDTC\0C0A\backup.exe
C:\Windows\INF\MSDTC\0C0A\backup.exe C:\Windows\INF\MSDTC\0C0A\
1⤵
PID:4908

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\
1⤵
PID:2588
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1324

C:\Windows\INF\MSDTC Bridge 3.0.0.0\backup.exe
"C:\Windows\INF\MSDTC Bridge 3.0.0.0\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\
1⤵
PID:2784
- C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\backup.exe
  "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\
  2⤵
  PID:3572

C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
1⤵
PID:3088

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\
1⤵
PID:3900

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\
1⤵
PID:2056
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\
  2⤵
  PID:4868

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\
1⤵
PID:3704

C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
1⤵
PID:2376

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\
1⤵
PID:2436
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\
  2⤵
  PID:3732

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
1⤵
PID:3428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\
1⤵
PID:3960

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3276

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\
1⤵
PID:1900

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\
1⤵
PID:4912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\
1⤵
PID:3332

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\
1⤵
PID:3604
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\
  2⤵
  PID:60

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1152

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\
1⤵
PID:5116

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\
1⤵
PID:2940
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\
  2⤵
  PID:3092

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\
1⤵
PID:4468

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\
1⤵
PID:3060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\
1⤵
PID:2968

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\
1⤵
PID:3308

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1604

C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
1⤵
PID:4952

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0407\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0407\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0407\
1⤵
PID:3048

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\
1⤵
PID:1664
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3828

C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\
1⤵
PID:3164

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\
1⤵
PID:4156

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\
1⤵
PID:4856

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\
1⤵
PID:1900

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\
1⤵
PID:2672

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0411\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0411\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0411\
1⤵
PID:4896

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:3804

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\
1⤵
PID:3464

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\
1⤵
PID:3472
- C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\data.exe
  "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\data.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\
  2⤵
  PID:2980
- - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\
    3⤵
    PID:3904
- - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\
    3⤵
    PID:2368

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\
1⤵
PID:4780

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0C0A\data.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0C0A\data.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0C0A\
1⤵
PID:1964

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:4444

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\
1⤵
PID:4112

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\
1⤵
PID:752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\
1⤵
PID:3984

C:\Windows\INF\PERFLIB\0407\backup.exe
C:\Windows\INF\PERFLIB\0407\backup.exe C:\Windows\INF\PERFLIB\0407\
1⤵
PID:2864

C:\Windows\INF\PERFLIB\040C\backup.exe
C:\Windows\INF\PERFLIB\040C\backup.exe C:\Windows\INF\PERFLIB\040C\
1⤵
PID:2456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\
1⤵
PID:2624

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:3092

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\data.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\
1⤵
PID:2436
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\
  2⤵
  PID:968
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\
  2⤵
  PID:2916

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\
1⤵
PID:4032
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\
  2⤵
  PID:4532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\
1⤵
PID:5112

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\
1⤵
PID:4248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\
1⤵
PID:4688

C:\Program Files\WindowsPowerShell\Modules\PSReadline\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\
1⤵
PID:752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\
1⤵
PID:4476

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\
1⤵
PID:4560

C:\Windows\InputMethod\System Restore.exe
"C:\Windows\InputMethod\System Restore.exe" C:\Windows\InputMethod\
1⤵
PID:1324
- C:\Windows\InputMethod\SHARED\backup.exe
  C:\Windows\InputMethod\SHARED\backup.exe C:\Windows\InputMethod\SHARED\
  2⤵
  PID:5076

C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
1⤵
PID:5068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\
1⤵
PID:3040

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\
1⤵
PID:4052

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:4812

C:\Windows\INF\PNRPSvc\040C\backup.exe
C:\Windows\INF\PNRPSvc\040C\backup.exe C:\Windows\INF\PNRPSvc\040C\
1⤵
PID:2760

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:408

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\
1⤵
PID:4924

C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
1⤵
PID:1328

C:\Windows\INF\PNRPSvc\0411\backup.exe
C:\Windows\INF\PNRPSvc\0411\backup.exe C:\Windows\INF\PNRPSvc\0411\
1⤵
PID:1444

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\
1⤵
PID:3708

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\
1⤵
PID:2372

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\
1⤵
PID:1632
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2000
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:3060

C:\Program Files\VideoLAN\VLC\locale\sm\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sm\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sm\
1⤵
PID:4804

C:\Windows\Logs\backup.exe
C:\Windows\Logs\backup.exe C:\Windows\Logs\
1⤵
PID:4496
- C:\Windows\Logs\HomeGroup\backup.exe
  C:\Windows\Logs\HomeGroup\backup.exe C:\Windows\Logs\HomeGroup\
  2⤵
  PID:3296
- C:\Windows\Logs\SettingSync\backup.exe
  C:\Windows\Logs\SettingSync\backup.exe C:\Windows\Logs\SettingSync\
  2⤵
  PID:2320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\
1⤵
PID:3272

C:\Windows\INF\rdyboost\0409\System Restore.exe
"C:\Windows\INF\rdyboost\0409\System Restore.exe" C:\Windows\INF\rdyboost\0409\
1⤵
PID:2436

C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
1⤵
PID:1328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\
1⤵
PID:5096

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\d0d5ef42c0e8cf225d6f02493cafd965\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\d0d5ef42c0e8cf225d6f02493cafd965\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\d0d5ef42c0e8cf225d6f02493cafd965\
1⤵
PID:5084

C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
1⤵
PID:1476

C:\Windows\INF\rdyboost\0411\backup.exe
C:\Windows\INF\rdyboost\0411\backup.exe C:\Windows\INF\rdyboost\0411\
1⤵
PID:3572

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\
1⤵
PID:4816

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\
1⤵
PID:32

C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
1⤵
PID:956

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\
1⤵
PID:4288

C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
1⤵
PID:5076

C:\Windows\Media\backup.exe
C:\Windows\Media\backup.exe C:\Windows\Media\
1⤵
PID:432

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1436

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc#\81091ae499b2593b4e8a4b012e6a7c1b\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc#\81091ae499b2593b4e8a4b012e6a7c1b\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc#\81091ae499b2593b4e8a4b012e6a7c1b\
1⤵
PID:3424

C:\Windows\INF\RemoteAccess\0410\backup.exe
C:\Windows\INF\RemoteAccess\0410\backup.exe C:\Windows\INF\RemoteAccess\0410\
1⤵
PID:4244

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:3960

C:\Windows\INF\RemoteAccess\0411\backup.exe
C:\Windows\INF\RemoteAccess\0411\backup.exe C:\Windows\INF\RemoteAccess\0411\
1⤵
PID:4896

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\
1⤵
PID:4032

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\
1⤵
PID:4308

C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\
1⤵
PID:380
- C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\
  2⤵
  PID:4328
- C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands\
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
  2⤵
  PID:1800
- - C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
    C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\
    3⤵
    PID:880
- C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\data.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\data.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\
  2⤵
  PID:1332
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe
  "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\
  2⤵
  PID:4200

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\
1⤵
PID:4316

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\
1⤵
PID:2596

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
1⤵
PID:4880

C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\data.exe C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:1728

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\a32f4f54a0df42f1dc8d6cb91d471bb9\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\a32f4f54a0df42f1dc8d6cb91d471bb9\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\a32f4f54a0df42f1dc8d6cb91d471bb9\
1⤵
PID:4968

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\
1⤵
PID:2272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\
1⤵
PID:1604
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\
  2⤵
  PID:5032

C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\backup.exe
"C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\
1⤵
PID:2076

C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\backup.exe
"C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0411\
1⤵
PID:2168

C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
1⤵
PID:1904

C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\
1⤵
PID:3092
- C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\
  2⤵
  PID:5072
- - C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\
    3⤵
    PID:1620
- C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\
  2⤵
  PID:3048
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\
  2⤵
  PID:4700
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\
  2⤵
  PID:2448
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\
  2⤵
  PID:3064
- - C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\
    3⤵
    PID:4932
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\
  2⤵
  PID:980
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\
  2⤵
  PID:3220
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\System Restore.exe
  "C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\
  2⤵
  PID:968
- - C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\
    3⤵
    PID:4676
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\
  2⤵
  PID:1368
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\
  2⤵
  PID:4104
- - C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\17e8d62f031d58fe723473a6a11c4ad1\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\17e8d62f031d58fe723473a6a11c4ad1\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\17e8d62f031d58fe723473a6a11c4ad1\
    3⤵
    PID:3904
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\
  2⤵
  PID:3708
- - C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\
    3⤵
    PID:492
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\
  2⤵
  PID:4368
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\
  2⤵
  PID:2232

C:\Windows\INF\ServiceModelOperation 3.0.0.0\data.exe
"C:\Windows\INF\ServiceModelOperation 3.0.0.0\data.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\
1⤵
PID:2456
- C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\backup.exe
  "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0000\
  2⤵
  PID:2396
- C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\backup.exe
  "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\
  2⤵
  PID:1548
- C:\Windows\INF\ServiceModelOperation 3.0.0.0\040C\backup.exe
  "C:\Windows\INF\ServiceModelOperation 3.0.0.0\040C\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\040C\
  2⤵
  PID:4136
- C:\Windows\INF\ServiceModelOperation 3.0.0.0\0410\backup.exe
  "C:\Windows\INF\ServiceModelOperation 3.0.0.0\0410\backup.exe" C:\Windows\INF\ServiceModelOperation 3.0.0.0\0410\
  2⤵
  PID:3484

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\
1⤵
PID:5020
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\3baadacb9af97508e821559b2b24c448\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\3baadacb9af97508e821559b2b24c448\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\3baadacb9af97508e821559b2b24c448\
  2⤵
  PID:2428

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:4780

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:3424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\
1⤵
PID:4920
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\
  2⤵
  PID:788
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\
  2⤵
  PID:3492
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\
  2⤵
  PID:792
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\
  2⤵
  PID:4404
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\
  2⤵
  PID:4668
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\
  2⤵
  PID:1592
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\
  2⤵
  PID:2928
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\
  2⤵
  PID:1012
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\
  2⤵
  PID:1324

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\
1⤵
PID:2848
- C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:2300
- C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:3964

C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
1⤵
PID:1440

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\
1⤵
PID:4820

C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
1⤵
PID:3116

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:1464

C:\Windows\INF\ServiceModelService 3.0.0.0\0407\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0407\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0407\
1⤵
PID:1664

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4736

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2760

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:3824

C:\Windows\INF\ServiceModelService 3.0.0.0\0410\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0410\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0410\
1⤵
PID:4780

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:4488

C:\Windows\INF\ServiceModelService 3.0.0.0\0411\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0411\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0411\
1⤵
PID:752

C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\update.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\
1⤵
PID:5112

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:232

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\
1⤵
PID:4236

C:\Windows\INF\SMSvcHost 3.0.0.0\backup.exe
"C:\Windows\INF\SMSvcHost 3.0.0.0\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\
1⤵
PID:924
- C:\Windows\INF\SMSvcHost 3.0.0.0\0409\backup.exe
  "C:\Windows\INF\SMSvcHost 3.0.0.0\0409\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0409\
  2⤵
  PID:3716
- C:\Windows\INF\SMSvcHost 3.0.0.0\0411\backup.exe
  "C:\Windows\INF\SMSvcHost 3.0.0.0\0411\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0411\
  2⤵
  PID:3712
- C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe
  "C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\
  2⤵
  PID:4968

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\4de3858b9394861311e54b68def9b9f1\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\4de3858b9394861311e54b68def9b9f1\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\4de3858b9394861311e54b68def9b9f1\
1⤵
PID:5116

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\
1⤵
PID:2332

C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\
1⤵
PID:2184
- C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\napinit\1aadf48268feebf254c480273caa6ff0\
  2⤵
  PID:3192

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\update.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:2156

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\903ffecbd077dc9907c3618278188386\
1⤵
PID:3900

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\
1⤵
PID:220
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:5100

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:3328

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\
1⤵
PID:1916

C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe
"C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\
1⤵
PID:1572
- C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe
  "C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\0411\
  2⤵
  PID:3688

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:5084

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:216

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4560

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\
1⤵
PID:3900

C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\679ef210e507dd4acebe324d3d5fd13a\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\679ef210e507dd4acebe324d3d5fd13a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\679ef210e507dd4acebe324d3d5fd13a\
1⤵
PID:1592

C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\
1⤵
PID:2548

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\
1⤵
PID:1864

C:\Windows\assembly\NativeImages_v4.0.30319_32\System\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System\
1⤵
PID:1468

C:\Windows\INF\TAPISRV\backup.exe
C:\Windows\INF\TAPISRV\backup.exe C:\Windows\INF\TAPISRV\
1⤵
PID:2676

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:3880

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:5112

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\4a9323e1e332fcc6d5128407fd3404f3\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\4a9323e1e332fcc6d5128407fd3404f3\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\4a9323e1e332fcc6d5128407fd3404f3\
1⤵
PID:4544

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:3492

C:\Windows\INF\TermService\0410\backup.exe
C:\Windows\INF\TermService\0410\backup.exe C:\Windows\INF\TermService\0410\
1⤵
PID:1548

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\
1⤵
PID:3428

C:\Windows\INF\TermService\0411\backup.exe
C:\Windows\INF\TermService\0411\backup.exe C:\Windows\INF\TermService\0411\
1⤵
PID:3840

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\
1⤵
PID:552

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\
1⤵
PID:3712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\
  2⤵
  PID:4816
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\
  2⤵
  PID:3824

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\System Restore.exe
"C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\
1⤵
PID:2464

C:\Windows\INF\UGatherer\0410\backup.exe
C:\Windows\INF\UGatherer\0410\backup.exe C:\Windows\INF\UGatherer\0410\
1⤵
PID:1636

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:4896

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\
1⤵
PID:1440

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656#\2997d4b330208b9b0dad2875b7e0d82a\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656#\2997d4b330208b9b0dad2875b7e0d82a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656#\2997d4b330208b9b0dad2875b7e0d82a\
1⤵
PID:4936

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\
1⤵
PID:4660

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\
1⤵
PID:956

C:\Windows\INF\UGatherer\0C0A\backup.exe
C:\Windows\INF\UGatherer\0C0A\backup.exe C:\Windows\INF\UGatherer\0C0A\
1⤵
PID:4944

C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\
1⤵
PID:2708

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\
1⤵
PID:600

C:\Windows\INF\UGTHRSVC\backup.exe
C:\Windows\INF\UGTHRSVC\backup.exe C:\Windows\INF\UGTHRSVC\
1⤵
PID:4308
- C:\Windows\INF\UGTHRSVC\040C\backup.exe
  C:\Windows\INF\UGTHRSVC\040C\backup.exe C:\Windows\INF\UGTHRSVC\040C\
  2⤵
  PID:1532
- C:\Windows\INF\UGTHRSVC\0411\backup.exe
  C:\Windows\INF\UGTHRSVC\0411\backup.exe C:\Windows\INF\UGTHRSVC\0411\
  2⤵
  PID:1916

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4904

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:4776

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\
1⤵
PID:3720

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\
1⤵
PID:860

C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:2460

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\
1⤵
PID:4876

C:\Windows\ModemLogs\backup.exe
C:\Windows\ModemLogs\backup.exe C:\Windows\ModemLogs\
1⤵
PID:1392

C:\Windows\Offline Web Pages\backup.exe
"C:\Windows\Offline Web Pages\backup.exe" C:\Windows\Offline Web Pages\
1⤵
PID:492

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\
1⤵
PID:2244

C:\Windows\INF\usbhub\backup.exe
C:\Windows\INF\usbhub\backup.exe C:\Windows\INF\usbhub\
1⤵
PID:4264
- C:\Windows\INF\usbhub\0410\backup.exe
  C:\Windows\INF\usbhub\0410\backup.exe C:\Windows\INF\usbhub\0410\
  2⤵
  PID:5076
- C:\Windows\INF\usbhub\0411\backup.exe
  C:\Windows\INF\usbhub\0411\backup.exe C:\Windows\INF\usbhub\0411\
  2⤵
  PID:1940
- C:\Windows\INF\usbhub\0C0A\backup.exe
  C:\Windows\INF\usbhub\0C0A\backup.exe C:\Windows\INF\usbhub\0C0A\
  2⤵
  PID:4592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\
1⤵
PID:4900

C:\Windows\Panther\actionqueue\backup.exe
C:\Windows\Panther\actionqueue\backup.exe C:\Windows\Panther\actionqueue\
1⤵
PID:2800

C:\Windows\assembly\temp\System Restore.exe
"C:\Windows\assembly\temp\System Restore.exe" C:\Windows\assembly\temp\
1⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\3082\backup.exe
C:\Windows\Microsoft.NET\Framework\3082\backup.exe C:\Windows\Microsoft.NET\Framework\3082\
1⤵
PID:3308

C:\Windows\Panther\UnattendGC\backup.exe
C:\Windows\Panther\UnattendGC\backup.exe C:\Windows\Panther\UnattendGC\
1⤵
PID:4196

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2464

C:\Windows\Performance\WinSAT\backup.exe
C:\Windows\Performance\WinSAT\backup.exe C:\Windows\Performance\WinSAT\
1⤵
PID:3688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\
1⤵
PID:412

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4384

C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4388

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:3392

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\
1⤵
PID:3224

C:\Windows\PLA\Reports\de-DE\backup.exe
C:\Windows\PLA\Reports\de-DE\backup.exe C:\Windows\PLA\Reports\de-DE\
1⤵
PID:752

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\
1⤵
PID:2504

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:4668

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\
1⤵
PID:1908

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4132

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\
1⤵
PID:3448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\
1⤵
PID:4748

C:\Windows\PLA\Reports\ja-JP\backup.exe
C:\Windows\PLA\Reports\ja-JP\backup.exe C:\Windows\PLA\Reports\ja-JP\
1⤵
PID:3256

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4676

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\
1⤵
PID:4256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\
1⤵
PID:4804

C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\
1⤵
PID:4500
- C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\backup.exe
  "C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\
  2⤵
  PID:1168
- C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\backup.exe
  "C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\
  2⤵
  PID:2276

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\
1⤵
PID:3572
- C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:4036

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:3688

C:\Windows\PLA\Rules\es-ES\backup.exe
C:\Windows\PLA\Rules\es-ES\backup.exe C:\Windows\PLA\Rules\es-ES\
1⤵
PID:4284

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\
1⤵
PID:3472

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\
1⤵
PID:3428

C:\Windows\PLA\Rules\it-IT\backup.exe
C:\Windows\PLA\Rules\it-IT\backup.exe C:\Windows\PLA\Rules\it-IT\
1⤵
PID:5112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\
1⤵
PID:3696
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\backup.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\
  2⤵
  PID:4816

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\
1⤵
PID:436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\
1⤵
PID:4296

C:\Windows\PLA\System\backup.exe
C:\Windows\PLA\System\backup.exe C:\Windows\PLA\System\
1⤵
PID:3484

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:2536

C:\Windows\INF\wsearchidxpi\backup.exe
C:\Windows\INF\wsearchidxpi\backup.exe C:\Windows\INF\wsearchidxpi\
1⤵
PID:4112
- C:\Windows\INF\wsearchidxpi\0410\System Restore.exe
  "C:\Windows\INF\wsearchidxpi\0410\System Restore.exe" C:\Windows\INF\wsearchidxpi\0410\
  2⤵
  PID:2928
- C:\Windows\INF\wsearchidxpi\0411\backup.exe
  C:\Windows\INF\wsearchidxpi\0411\backup.exe C:\Windows\INF\wsearchidxpi\0411\
  2⤵
  PID:4608

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\
1⤵
PID:1664
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\
  2⤵
  PID:5068

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:4460

C:\Windows\PolicyDefinitions\en-US\backup.exe
C:\Windows\PolicyDefinitions\en-US\backup.exe C:\Windows\PolicyDefinitions\en-US\
1⤵
PID:1728

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\
1⤵
PID:3044

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\
1⤵
PID:436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\
1⤵
PID:3148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\
1⤵
PID:3724

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\
1⤵
PID:2460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\
1⤵
PID:860

C:\Windows\Prefetch\System Restore.exe
"C:\Windows\Prefetch\System Restore.exe" C:\Windows\Prefetch\
1⤵
PID:2060
- C:\Windows\Prefetch\ReadyBoot\backup.exe
  C:\Windows\Prefetch\ReadyBoot\backup.exe C:\Windows\Prefetch\ReadyBoot\
  2⤵
  PID:4472

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\
1⤵
PID:4952

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:3784

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\
1⤵
PID:4468

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\
1⤵
PID:2988

C:\Windows\PrintDialog\Assets\backup.exe
C:\Windows\PrintDialog\Assets\backup.exe C:\Windows\PrintDialog\Assets\
1⤵
PID:3188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\
1⤵
PID:4544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\
1⤵
PID:1964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\de\backup.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\de\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\de\
  2⤵
  PID:4808

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\
1⤵
PID:2208

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:5076

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\9d4fa51c0199ef8faead7b940eba2662\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\9d4fa51c0199ef8faead7b940eba2662\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\9d4fa51c0199ef8faead7b940eba2662\
1⤵
PID:4464

C:\Windows\Provisioning\Cosa\MO\backup.exe
C:\Windows\Provisioning\Cosa\MO\backup.exe C:\Windows\Provisioning\Cosa\MO\
1⤵
PID:3732

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:3160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\
1⤵
PID:4952

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
1⤵
PID:1516

C:\Windows\RemotePackages\RemoteApps\backup.exe
C:\Windows\RemotePackages\RemoteApps\backup.exe C:\Windows\RemotePackages\RemoteApps\
1⤵
PID:4804

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:4552

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\
1⤵
PID:3396

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\040C\System Restore.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\040C\System Restore.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\040C\
1⤵
PID:4476

C:\Windows\Resources\Ease of Access Themes\backup.exe
"C:\Windows\Resources\Ease of Access Themes\backup.exe" C:\Windows\Resources\Ease of Access Themes\
1⤵
PID:4156

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\
1⤵
PID:3060

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\
1⤵
PID:2520

C:\Windows\Microsoft.NET\Framework64\1031\backup.exe
C:\Windows\Microsoft.NET\Framework64\1031\backup.exe C:\Windows\Microsoft.NET\Framework64\1031\
1⤵
PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\update.exe

Filesize
122KB

MD5
3c75aae1b0fa194c823428268f7a4c96

SHA1
fe599c731c39e8dc04d342b9f8192d39cdfba79a

SHA256
ec5262d2433a66c3380754463d5058eba8d9135f214710c4005824b08125af74

SHA512
288b4ab5017d4d80dd9e76fecf8fb27ef3988cdede51e52ba99395ed67502549268495489e5220b735b2b2443df94904f013f5be971cf152ab72b36b919d5f80

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
7bad6975c8e9e837f19f93347346d201

SHA1
1fbde71b4576ec9cd6684be8b5aa2c3077e6ccf9

SHA256
71a13469efb91e16cd192e87448b93ab3540fe4b27385bb1b2d3f5c6f7047790

SHA512
6f0030772b583c4d7d0f47952a79489961c409160c13421778b665c3f053c2da828788c2ae3d2ff9e020e2ad84526307344e75ffb8c84c7585e84e417c8262ec

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
830b2c5828ff3223e3a00f353b922534

SHA1
3cfe05a3f915b245ea927e77ce5b24a1c92a0051

SHA256
dac047df2da9cc2e24b663061901e46a266d0de0165ac8cca79feb840c0a1ea9

SHA512
6479daf7f5101496f9122b424658c2e5432ce19f2bbff5edac145d8c214033d765a4e0e76936bba7ace3e4d9f098be0096f6ec52c2ce56ff1f1b0e7342a28ea8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
122KB

MD5
f7f4753aaefe607416b088d931931040

SHA1
e685ae882ff07325bf591cdd56b27b7e5395dc92

SHA256
f2df2cae1207b230893bcc93c374debeea3bc5536f2c1535899a91c8b3827db0

SHA512
c7aa0daa24d72945fc245f7c3f14389c70fd6dd41ca5756905a58ffc08805f935a9f4ba1001216305ceb5fef29fd6804cbcc837fd3ff4b6226004b3d006ed5be

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
b6b52487d5f1d7b36eb77164a5c52f2c

SHA1
7f4d1a83f350f4bbb7241547ffae26dbc6d5ae87

SHA256
d2bfe3b4b4f7b74451571ee2c69529c37fe73ec5024df965b2bdc1c8855d0c81

SHA512
448c1bacf87b2b69641b1db9f8a78a99447de8c99ff8f93814a622cdcd608555f6cbaf28b81ccb89faf78fa28bf461d4ff44f41b514559a09f7bd28d86f3ff8c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

Filesize
122KB

MD5
f3bd26379434789e76a8169d8c9b9f1b

SHA1
93a9dbe00540cdb0c378b1e67e9f0bc58bc9146e

SHA256
e2304648f13a74a89a4acddd3d7eeaad8ba8a5960abd256a71359198bf5cb1ec

SHA512
e305b86f4d56ff07f05df149e15b5b8410cdfe898ecb2695c9bb8a12c21ae516c72263efc1a4e58aacc85e817add0a092ee27e0f082ab5bd1f51ce02868781ef

Download Submit
C:\Program Files\backup.exe

Filesize
122KB

MD5
f5fedd90ecece2b867c7a91d340066f8

SHA1
3f3bef094a89518a128ac530a560c8b05507bc25

SHA256
a44c0b47e3d66ed3e80be96deb8bc933393e89bf79c1e32a6e0ae1374448fa9a

SHA512
f780ffa7e468af8d308695592a397fd34827a581f3809e07bf1624cc0df596066d2d4ed9c7d228927a033858b44901179993224e77d4bab5fbd1f11ad9bba95f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
122KB

MD5
df2ec4b28fef941b2434ef6706a2f3c8

SHA1
6ccef0cf549ac5cc42a3e600e8341d40c305b100

SHA256
c7708acec8d5fcc7d7a54cfc27fb788d4547304972737c47eaa91463e1c693f4

SHA512
08b6ea997d45438c5c9766f67cf69170818466fcf34dd87cc18399df7df009710ba5c6d7c8e88e212d0aac597446782dfebff9ece57fd5bf30aa8a05382c1cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
fecd6b84368cfaa424798dc3a71a57ce

SHA1
266d6b52784180da5b101c1693d5162d9f29f8a8

SHA256
6e515c2077edd74ca0b7f349f945c235624fafe5f0ed667fe2eb87409b326e51

SHA512
fc786c6c58794980fcfda798de3a2ec500102ef20c04c5c7d94ce1b4aa728eabc61a13d50b4faf130b322f32f5a88c8ed8a3234da791d489fc993bddea7a1ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{992A566B-C445-493B-A5B9-E23736A52C9E}\backup.exe

Filesize
122KB

MD5
117a7d2a258a80d1565dd136d7669b64

SHA1
5098acc71f4c6d1841ba4b8d91c3fbb2cdec0fb5

SHA256
e9cc55ae3dfb040c8fc16f13c4cb07cd6b94283d90f0118054655f08cf454868

SHA512
8bf3d676d2fa5f1b1552bcc050cfed6f5d9efcfd97a6438a9eebcb218fe16a16b8cb0803845a177a0dd6c14551a95f7c3499630745408645c575b4da3a783f01

Download Submit
C:\update.exe

Filesize
122KB

MD5
8662782f4ef0295318e33ca2cbd2afb7

SHA1
9497bbfa5b1b1ad810b9d4b970da957b8e3f2db3

SHA256
352f991c578a4603659cfabc184736b5bfd0f95d6e6c5b6d08f2084db1477800

SHA512
d0923fe069a66151802652b512effc0e323c50dfeae378a549d5f221e9d1b9c1018ede2adda5f00f1c44c0f4382c637a00f3793f2da0751c9d9ebb00b29ba7b4

Download Submit
memory/396-411-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/600-656-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/788-682-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/956-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/956-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/980-119-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1052-294-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1076-385-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1228-563-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1308-272-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1452-695-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1536-254-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1728-712-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1804-250-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1940-463-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-476-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2308-234-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2352-178-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2432-126-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2436-707-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-607-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2476-277-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2736-729-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2852-569-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2864-506-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2864-503-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2928-183-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2936-99-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3040-458-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3256-433-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3308-240-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3332-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3384-395-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3424-194-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3476-650-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3492-368-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3492-557-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3556-327-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3700-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3700-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3788-661-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3824-482-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3928-601-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4172-246-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4288-448-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4328-261-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4332-453-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4440-582-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4464-700-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4580-219-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4776-429-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4780-309-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4780-540-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4808-719-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4876-299-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4888-400-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4932-267-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4948-524-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4948-761-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5020-518-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5100-674-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads