9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe
Size

72KB
MD5

6562f386a1512b43257e6ddb18d54240
SHA1

412d32157702840822cc7ded6f1a2102d6ea79f1
SHA256

9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234
SHA512

d02d076af43d8082f01a13997092b29e5064fed67fa9f9ea238f1ec875110387e66314ab173e634f86d4a45d331a041210347e77659def05b00fb8d50e7b6af5
SSDEEP

768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd/+I9HL:HeT7BVwxfvqguKp+Sr

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe

Executes dropped EXE 3 IoCs

pid	Process
3492	backup.exe
1864	backup.exe
840	backup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe
3492	backup.exe
1864	backup.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3492	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	82
PID 3680 wrote to memory of 3492	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	82
PID 3680 wrote to memory of 3492	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	82
PID 3680 wrote to memory of 1864	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	83
PID 3680 wrote to memory of 1864	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	83
PID 3680 wrote to memory of 1864	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	83
PID 3680 wrote to memory of 840	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	84
PID 3680 wrote to memory of 840	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	84
PID 3680 wrote to memory of 840	3680	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe	84

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe
"C:\Users\Admin\AppData\Local\Temp\9c12911592d84b3687b7cbcc1761d5fea64e96cf12446d71e4422ea6bfc65234.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3680
- C:\Users\Admin\AppData\Local\Temp\{B92826C1-EE11-4152-BB67-B6780B38D38B}\backup.exe
  C:\Users\Admin\AppData\Local\Temp\{B92826C1-EE11-4152-BB67-B6780B38D38B}\backup.exe C:\Users\Admin\AppData\Local\Temp\{B92826C1-EE11-4152-BB67-B6780B38D38B}\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\1839151860\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1839151860\backup.exe C:\Users\Admin\AppData\Local\Temp\1839151860\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\
  2⤵
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
    C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\
    3⤵
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
      C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\
      4⤵
      PID:4120

C:\Program Files\7-Zip\Lang\backup.exe
"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
1⤵
PID:2248

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:1044
- C:\Program Files\Common Files\DESIGNER\backup.exe
  "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
  2⤵
  PID:3872
- C:\Program Files\Common Files\microsoft shared\backup.exe
  "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
  2⤵
  PID:3292
- - C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
    3⤵
    PID:4132
- - C:\Program Files\Common Files\microsoft shared\ink\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
    3⤵
    PID:2256
  - - C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe
      "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
      4⤵
      PID:3408
  - - C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
      4⤵
      PID:3976
  - - C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\data.exe
      "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
      4⤵
      PID:1640
  - - C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
      4⤵
      PID:3548
  - - C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
      4⤵
      PID:1636
  - - C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
      4⤵
      PID:2088
  - - C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
      4⤵
      PID:3552
  - - C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
      4⤵
      PID:528
  - - C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
      4⤵
      PID:1104
  - - C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
      4⤵
      PID:4336
  - - C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
      4⤵
      PID:3740
  - - C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
      4⤵
      PID:4512
  - - C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
      4⤵
      PID:4756
  - - C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
      4⤵
      PID:1452
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
      4⤵
      PID:4112
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
        5⤵
        
        PID:3440
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
        5⤵
        
        PID:1744
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
        5⤵
        
        PID:3508
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
        5⤵
        
        PID:4440
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
        5⤵
        
        PID:4016
    - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
        5⤵
        
        PID:4148
  - - C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
      4⤵
      PID:3632
  - - C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
      4⤵
      PID:5024
  - - C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
      4⤵
      PID:2160
  - - C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
      4⤵
      PID:3200
  - - C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
      4⤵
      PID:5056
  - - C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
      4⤵
      PID:4272
  - - C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
      4⤵
      PID:2748
  - - C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
      4⤵
      PID:3228
  - - C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
      4⤵
      PID:2248
  - - C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
      4⤵
      PID:3384
  - - C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
      4⤵
      PID:1484
  - - C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
      4⤵
      PID:220
  - - C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
      4⤵
      PID:4144
  - - C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
      4⤵
      PID:2832
  - - C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
      4⤵
      PID:4892
  - - C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
      4⤵
      PID:1040
  - - C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
      4⤵
      PID:4464
  - - C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
      4⤵
      PID:2332
  - - C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
      4⤵
      PID:3436
  - - C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
      4⤵
      PID:4960
  - - C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
      4⤵
      PID:1832
  - - C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
      4⤵
      PID:728
  - - C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe
      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
      4⤵
      PID:3628
- - C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
    3⤵
    PID:1148
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
      4⤵
      PID:4808
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
      4⤵
      PID:3896
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
      4⤵
      PID:2220
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
      4⤵
      PID:4904
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
      4⤵
      PID:2892
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
      4⤵
      PID:1704
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\
      4⤵
      PID:1308
- - C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
    "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
    3⤵
    PID:4856
  - - C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
      "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
      4⤵
      PID:4480
- - C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
    3⤵
    PID:3624
- - C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
    3⤵
    PID:1532
- - C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
    3⤵
    PID:3100
- - C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
    "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
    3⤵
    PID:3668
  - - C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe
      "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
      4⤵
      PID:2916
- - C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
    3⤵
    PID:4192
  - - C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
      4⤵
      PID:5008
- - C:\Program Files\Common Files\microsoft shared\VC\backup.exe
    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
    3⤵
    PID:2212
- - C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
    3⤵
    PID:2544
- - C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
    3⤵
    PID:2160
  - - C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
      4⤵
      PID:4508
- C:\Program Files\Common Files\System\backup.exe
  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
  2⤵
  PID:940
- - C:\Program Files\Common Files\System\ado\backup.exe
    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
    3⤵
    PID:3188
  - - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
      4⤵
      PID:3416
  - - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
      4⤵
      PID:1728
- - C:\Program Files\Common Files\System\de-DE\backup.exe
    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
    3⤵
    PID:3128
- - C:\Program Files\Common Files\System\en-US\backup.exe
    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
    3⤵
    PID:716
- - C:\Program Files\Common Files\System\es-ES\backup.exe
    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
    3⤵
    PID:4488
- - C:\Program Files\Common Files\System\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
    3⤵
    PID:1292
- - C:\Program Files\Common Files\System\it-IT\backup.exe
    "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
    3⤵
    PID:3548
- - C:\Program Files\Common Files\System\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
    3⤵
    PID:4188
- - C:\Program Files\Common Files\System\msadc\backup.exe
    "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
    3⤵
    PID:3980
  - - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
      "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
      4⤵
      PID:1184
  - - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
      "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
      4⤵
      PID:5036
  - - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
      4⤵
      PID:2300
- - C:\Program Files\Common Files\System\Ole DB\System Restore.exe
    "C:\Program Files\Common Files\System\Ole DB\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\
    3⤵
    PID:2380
  - - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
      "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
      4⤵
      PID:3740
  - - C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
      "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
      4⤵
      PID:2384
  - - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
      "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
      4⤵
      PID:960

C:\Program Files\dotnet\backup.exe
"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\
1⤵
PID:3624
- C:\Program Files\dotnet\host\backup.exe
  "C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\
  2⤵
  PID:3992
- - C:\Program Files\dotnet\host\fxr\backup.exe
    "C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\
    3⤵
    PID:5104
  - - C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe
      "C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.27\
      4⤵
      PID:3652
  - - C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe
      "C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe" C:\Program Files\dotnet\host\fxr\7.0.16\
      4⤵
      PID:5100
  - - C:\Program Files\dotnet\host\fxr\8.0.2\backup.exe
      "C:\Program Files\dotnet\host\fxr\8.0.2\backup.exe" C:\Program Files\dotnet\host\fxr\8.0.2\
      4⤵
      PID:4216
- C:\Program Files\dotnet\shared\backup.exe
  "C:\Program Files\dotnet\shared\backup.exe" C:\Program Files\dotnet\shared\
  2⤵
  PID:1232
- - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\
    3⤵
    PID:5088
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\
      4⤵
      PID:2544
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\
      4⤵
      PID:1464
  - - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\
      4⤵
      PID:2856
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\
    3⤵
    PID:4508
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\
      4⤵
      PID:3232
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\
        5⤵
        
        PID:3120
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\
        5⤵
        
        PID:3228
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\
        5⤵
        
        PID:4640
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\
        5⤵
        
        PID:1668
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\
        5⤵
        
        PID:212
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\
        5⤵
        
        PID:4088
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\
      4⤵
      PID:1636
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\
        5⤵
        
        PID:3848
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\
        5⤵
        
        PID:2868
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\
        5⤵
        
        PID:4268
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\
        5⤵
        
        PID:692
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\
      4⤵
      PID:2220
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\
        5⤵
        
        PID:60
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\
        5⤵
        
        PID:4628
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\update.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\
        5⤵
        
        PID:2224
    - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\backup.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\
        5⤵
        
        PID:4520
- C:\Program Files\dotnet\swidtag\backup.exe
  "C:\Program Files\dotnet\swidtag\backup.exe" C:\Program Files\dotnet\swidtag\
  2⤵
  PID:1688

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:3936
- C:\Program Files\Google\Chrome\backup.exe
  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
  2⤵
  PID:1272
- - C:\Program Files\Google\Chrome\Application\backup.exe
    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
    3⤵
    PID:1012
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\
      4⤵
      PID:5040
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\
        5⤵
        
        PID:4988
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\data.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\data.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\
        5⤵
        
        PID:4144
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\
        5⤵
        
        PID:3112

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\
1⤵
PID:3988

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:728

C:\Program Files\Internet Explorer\it-IT\backup.exe
"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
1⤵
PID:2660

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:1308
- C:\Program Files\Java\jdk-1.8\backup.exe
  "C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\
  2⤵
  PID:4376
- - C:\Program Files\Java\jdk-1.8\bin\backup.exe
    "C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
    3⤵
    PID:3256
- - C:\Program Files\Java\jdk-1.8\include\backup.exe
    "C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\
    3⤵
    PID:4952
  - - C:\Program Files\Java\jdk-1.8\include\win32\backup.exe
      "C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\
      4⤵
      PID:940
    - - C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\
        5⤵
        
        PID:4880
- - C:\Program Files\Java\jdk-1.8\jre\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\
    3⤵
    PID:2192
  - - C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\
      4⤵
      PID:4516
    - - C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
        5⤵
        
        PID:4252
    - - C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\
        5⤵
        
        PID:4812
    - - C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\
        5⤵
        
        PID:1140
  - - C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\
      4⤵
      PID:2896
    - - C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\
        5⤵
        
        PID:4124
    - - C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\
        5⤵
        
        PID:5112
  - - C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\
      4⤵
      PID:4536
    - - C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\
        5⤵
        
        PID:3380
    - - C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\
        5⤵
        
        PID:5088
    - - C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
        5⤵
        
        PID:1696
    - - C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\
        5⤵
        
        PID:3084
    - - C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\
        5⤵
        
        PID:744
    - - C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\
        5⤵
        
        PID:4248
    - - C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\
        5⤵
        
        PID:1876
      - C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\
        6⤵
        
        PID:608
    - - C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\
        5⤵
        
        PID:4204
    - - C:\Program Files\Java\jdk-1.8\jre\lib\management\System Restore.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\management\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\
        5⤵
        
        PID:4108
    - - C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\
        5⤵
        
        PID:4544
      - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\
        6⤵
        
        PID:3188
        
        C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\
        7⤵
        
        PID:1420
        
        C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\
        7⤵
        
        PID:2492
- - C:\Program Files\Java\jdk-1.8\legal\backup.exe
    "C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\
    3⤵
    PID:4092
  - - C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe
      "C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\
      4⤵
      PID:2888
  - - C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe
      "C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\
      4⤵
      PID:396
- - C:\Program Files\Java\jdk-1.8\lib\backup.exe
    "C:\Program Files\Java\jdk-1.8\lib\backup.exe" C:\Program Files\Java\jdk-1.8\lib\
    3⤵
    PID:1012
- C:\Program Files\Java\jre-1.8\backup.exe
  "C:\Program Files\Java\jre-1.8\backup.exe" C:\Program Files\Java\jre-1.8\
  2⤵
  PID:1496
- - C:\Program Files\Java\jre-1.8\bin\backup.exe
    "C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\
    3⤵
    PID:3628
  - - C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe
      "C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\
      4⤵
      PID:4660
  - - C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe
      "C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\
      4⤵
      PID:3432
  - - C:\Program Files\Java\jre-1.8\bin\server\backup.exe
      "C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\
      4⤵
      PID:2892
- - C:\Program Files\Java\jre-1.8\legal\backup.exe
    "C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\
    3⤵
    PID:692
  - - C:\Program Files\Java\jre-1.8\legal\javafx\System Restore.exe
      "C:\Program Files\Java\jre-1.8\legal\javafx\System Restore.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
      4⤵
      PID:1264
  - - C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe
      "C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\
      4⤵
      PID:2164
- - C:\Program Files\Java\jre-1.8\lib\backup.exe
    "C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\
    3⤵
    PID:2380
  - - C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\
      4⤵
      PID:1532
  - - C:\Program Files\Java\jre-1.8\lib\applet\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\
      4⤵
      PID:1136
  - - C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\
      4⤵
      PID:1764
  - - C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\
      4⤵
      PID:5080
  - - C:\Program Files\Java\jre-1.8\lib\ext\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\
      4⤵
      PID:4688
  - - C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\
      4⤵
      PID:4192
  - - C:\Program Files\Java\jre-1.8\lib\images\update.exe
      "C:\Program Files\Java\jre-1.8\lib\images\update.exe" C:\Program Files\Java\jre-1.8\lib\images\
      4⤵
      PID:2224
    - - C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\
        5⤵
        
        PID:2212
  - - C:\Program Files\Java\jre-1.8\lib\management\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\
      4⤵
      PID:2580
  - - C:\Program Files\Java\jre-1.8\lib\security\backup.exe
      "C:\Program Files\Java\jre-1.8\lib\security\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\
      4⤵
      PID:1604
    - - C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\
        5⤵
        
        PID:3380
      - C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\
        6⤵
        
        PID:5088
      - C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\
        6⤵
        
        PID:1232

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:4248

C:\Program Files\Java\jre8\lib\backup.exe
"C:\Program Files\Java\jre8\lib\backup.exe" C:\Program Files\Java\jre8\lib\
1⤵
PID:2852

C:\Program Files\Microsoft Office\Office16\backup.exe
"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
1⤵
PID:1520

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
1⤵
PID:3976

C:\Program Files\Microsoft Office\root\backup.exe
"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
1⤵
PID:4520
- C:\Program Files\Microsoft Office\root\Client\backup.exe
  "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
  2⤵
  PID:4060
- C:\Program Files\Microsoft Office\root\Office16\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\
  2⤵
  PID:1872
- - C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\
    3⤵
    PID:2380
- - C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\
    3⤵
    PID:4676
  - - C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\data.exe
      "C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\data.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\
      4⤵
      PID:5116
  - - C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\
      4⤵
      PID:3596
- - C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Configuration\
    3⤵
    PID:3484
- - C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\
    3⤵
    PID:4756
- - C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\
    3⤵
    PID:3436
- - C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f3\
    3⤵
    PID:1228
- - C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\
    3⤵
    PID:2340
- - C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_w1\
    3⤵
    PID:1308
- - C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\
    3⤵
    PID:2088
  - - C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\
      4⤵
      PID:4580
  - - C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\
      4⤵
      PID:944
- - C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MEDIA\
    3⤵
    PID:5024
- - C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\
    3⤵
    PID:1532
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\
      4⤵
      PID:3992
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\
      4⤵
      PID:2748
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\
      4⤵
      PID:4652
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\
      4⤵
      PID:4376
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\
      4⤵
      PID:3044
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\data.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\data.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\
      4⤵
      PID:1264
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\
      4⤵
      PID:1688
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\
      4⤵
      PID:4376
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\
      4⤵
      PID:4272
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\
      4⤵
      PID:3484
- - C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\
    3⤵
    PID:5040
- - C:\Program Files\Microsoft Office\root\Office16\SAMPLES\update.exe
    "C:\Program Files\Microsoft Office\root\Office16\SAMPLES\update.exe" C:\Program Files\Microsoft Office\root\Office16\SAMPLES\
    3⤵
    PID:3432
- - C:\Program Files\Microsoft Office\root\Office16\XLSTART\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\XLSTART\backup.exe" C:\Program Files\Microsoft Office\root\Office16\XLSTART\
    3⤵
    PID:4584
- C:\Program Files\Microsoft Office\root\Templates\backup.exe
  "C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\
  2⤵
  PID:4268
- - C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\
    3⤵
    PID:3436
  - - C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe
      "C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\
      4⤵
      PID:3952
- C:\Program Files\Microsoft Office\root\vfs\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\backup.exe" C:\Program Files\Microsoft Office\root\vfs\
  2⤵
  PID:1520
- - C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\
    3⤵
    PID:860
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\
    3⤵
    PID:1492
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\
      4⤵
      PID:404
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\
        5⤵
        
        PID:740
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\
        5⤵
        
        PID:4260
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\
        5⤵
        
        PID:4408
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\
      4⤵
      PID:3992
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\
        5⤵
        
        PID:4944
- - C:\Program Files\Microsoft Office\root\vfs\System\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\System\backup.exe" C:\Program Files\Microsoft Office\root\vfs\System\
    3⤵
    PID:4396
- C:\Program Files\Microsoft Office\root\vreg\backup.exe
  "C:\Program Files\Microsoft Office\root\vreg\backup.exe" C:\Program Files\Microsoft Office\root\vreg\
  2⤵
  PID:3652

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
1⤵
PID:4088
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
  2⤵
  PID:5040

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
1⤵
PID:4444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
1⤵
PID:4268

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
1⤵
PID:3116

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
1⤵
PID:1232

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\
1⤵
PID:3872
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\
  2⤵
  PID:4188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
1⤵
PID:3436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
1⤵
PID:3192

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\
1⤵
PID:1228

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\
1⤵
PID:4252
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\
  2⤵
  PID:1660
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\
  2⤵
  PID:4868
- C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\
  2⤵
  PID:3660
- - C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\
    3⤵
    PID:5108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
1⤵
PID:4216

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
1⤵
PID:3792

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
1⤵
PID:2212
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\System Restore.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
  2⤵
  PID:2896
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
    3⤵
    PID:3560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
      4⤵
      PID:3380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
1⤵
PID:4940
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
  2⤵
  PID:2332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
1⤵
PID:5040
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
  2⤵
  PID:404

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
1⤵
PID:3920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
1⤵
PID:2696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\
1⤵
PID:3784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\
1⤵
PID:1604
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\
  2⤵
  PID:4092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\
    3⤵
    PID:4992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\
1⤵
PID:2384

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\
1⤵
PID:2316

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\
1⤵
PID:512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\
1⤵
PID:3888
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\
  2⤵
  PID:4984
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\
    3⤵
    PID:5056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\
    3⤵
    PID:4464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\
    3⤵
    PID:3884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\
    3⤵
    PID:3348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\data.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\
    3⤵
    PID:1548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\
1⤵
PID:3256

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\
1⤵
PID:2552
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\
  2⤵
  PID:3232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\
    3⤵
    PID:4676
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\update.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\
    3⤵
    PID:4880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\data.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\
    3⤵
    PID:1524
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\
    3⤵
    PID:1140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\
    3⤵
    PID:1012
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\
    3⤵
    PID:5056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\
    3⤵
    PID:1636
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\
    3⤵
    PID:3848
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\
    3⤵
    PID:3612
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\
    3⤵
    PID:752
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\
    3⤵
    PID:4360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\
    3⤵
    PID:3852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\
    3⤵
    PID:3660
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\
    3⤵
    PID:1232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\
    3⤵
    PID:4504

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\
1⤵
PID:4800
- C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\
  2⤵
  PID:5092

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\
1⤵
PID:4880
- C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\
  2⤵
  PID:4688
- - C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\
    3⤵
    PID:4660
  - - C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\
      4⤵
      PID:3632
    - - C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\
        5⤵
        
        PID:2688

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\
1⤵
PID:3256

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\
1⤵
PID:4376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\
1⤵
PID:4652

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\
1⤵
PID:2888

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\
1⤵
PID:2160

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\
1⤵
PID:220

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\
1⤵
PID:1612

C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\private\
1⤵
PID:4636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\
1⤵
PID:2324

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\
1⤵
PID:2548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\
1⤵
PID:4188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\
1⤵
PID:1264

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\
1⤵
PID:1604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\
1⤵
PID:4700
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\
  2⤵
  PID:1872

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\
1⤵
PID:4588
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\
  2⤵
  PID:3432

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\
1⤵
PID:4756
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\
  2⤵
  PID:3968

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\
1⤵
PID:4688

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\
1⤵
PID:4508

C:\Users\Admin\3D Objects\backup.exe
"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
1⤵
PID:2064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
1⤵
PID:548

C:\Program Files\Microsoft Office\Updates\backup.exe
"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
1⤵
PID:1120

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:4460
- C:\Program Files\Mozilla Firefox\browser\features\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
  2⤵
  PID:3896

C:\Users\Admin\Documents\backup.exe
C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
1⤵
PID:4464

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe
"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
1⤵
PID:2040

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
1⤵
PID:2332
- C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
  2⤵
  PID:4248

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\
1⤵
PID:916

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
1⤵
PID:3680

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
1⤵
PID:3988
- C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\backup.exe
  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\
  2⤵
  PID:536

C:\Users\Admin\Downloads\backup.exe
C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
1⤵
PID:4192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\
1⤵
PID:912

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
1⤵
PID:4120

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
1⤵
PID:2324

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\
1⤵
PID:4248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
1⤵
PID:1532

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\System Restore.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
1⤵
PID:5116

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\
1⤵
PID:740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
1⤵
PID:1892

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\
1⤵
PID:4508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\
1⤵
PID:1832

C:\Users\Admin\Pictures\backup.exe
C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
1⤵
PID:1272
- C:\Users\Admin\Pictures\Camera Roll\backup.exe
  "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
  2⤵
  PID:1148
- C:\Users\Admin\Pictures\Saved Pictures\backup.exe
  "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
  2⤵
  PID:1816

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
1⤵
PID:4360

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\update.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\update.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2696
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:3552

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\
1⤵
PID:916

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
1⤵
PID:4088

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
1⤵
PID:2088

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\
1⤵
PID:2412

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
1⤵
PID:740

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:4392

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
1⤵
PID:4584

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:536
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:3720
- C:\Windows\appcompat\backup.exe
  C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
  2⤵
  PID:1612
- C:\Windows\assembly\backup.exe
  C:\Windows\assembly\backup.exe C:\Windows\assembly\
  2⤵
  PID:4132
- - C:\Windows\assembly\GAC\backup.exe
    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
    3⤵
    PID:5024
- - C:\Windows\assembly\temp\backup.exe
    C:\Windows\assembly\temp\backup.exe C:\Windows\assembly\temp\
    3⤵
    PID:2244
- C:\Windows\bcastdvr\backup.exe
  C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
  2⤵
  PID:3560
- C:\Windows\CbsTemp\backup.exe
  C:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\
  2⤵
  PID:1428
- C:\Windows\Globalization\backup.exe
  C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
  2⤵
  PID:400
- C:\Windows\ja-JP\backup.exe
  C:\Windows\ja-JP\backup.exe C:\Windows\ja-JP\
  2⤵
  PID:1872
- C:\Windows\LiveKernelReports\backup.exe
  C:\Windows\LiveKernelReports\backup.exe C:\Windows\LiveKernelReports\
  2⤵
  PID:3200
- C:\Windows\Logs\backup.exe
  C:\Windows\Logs\backup.exe C:\Windows\Logs\
  2⤵
  PID:3872
- - C:\Windows\Logs\CBS\System Restore.exe
    "C:\Windows\Logs\CBS\System Restore.exe" C:\Windows\Logs\CBS\
    3⤵
    PID:1532
- - C:\Windows\Logs\DISM\backup.exe
    C:\Windows\Logs\DISM\backup.exe C:\Windows\Logs\DISM\
    3⤵
    PID:3612
- - C:\Windows\Logs\DPX\backup.exe
    C:\Windows\Logs\DPX\backup.exe C:\Windows\Logs\DPX\
    3⤵
    PID:1528
- - C:\Windows\Logs\SettingSync\backup.exe
    C:\Windows\Logs\SettingSync\backup.exe C:\Windows\Logs\SettingSync\
    3⤵
    PID:3992
- - C:\Windows\Logs\WindowsUpdate\backup.exe
    C:\Windows\Logs\WindowsUpdate\backup.exe C:\Windows\Logs\WindowsUpdate\
    3⤵
    PID:1512
- C:\Windows\Media\backup.exe
  C:\Windows\Media\backup.exe C:\Windows\Media\
  2⤵
  PID:3052
- C:\Windows\Migration\backup.exe
  C:\Windows\Migration\backup.exe C:\Windows\Migration\
  2⤵
  PID:3940
- - C:\Windows\Migration\WTR\backup.exe
    C:\Windows\Migration\WTR\backup.exe C:\Windows\Migration\WTR\
    3⤵
    PID:2816
- C:\Windows\ModemLogs\backup.exe
  C:\Windows\ModemLogs\backup.exe C:\Windows\ModemLogs\
  2⤵
  PID:5036
- C:\Windows\Panther\backup.exe
  C:\Windows\Panther\backup.exe C:\Windows\Panther\
  2⤵
  PID:1620

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\
1⤵
PID:3988

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:4468
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:1044
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:3644

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
1⤵
PID:3192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\
1⤵
PID:512

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\
1⤵
PID:1604

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\
1⤵
PID:3436

C:\Windows\apppatch\AppPatch64\backup.exe
C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
1⤵
PID:3380

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:4916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\
1⤵
PID:3232
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\
  2⤵
  PID:4856

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\
1⤵
PID:1548

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\
1⤵
PID:3628

C:\Windows\apppatch\de-DE\backup.exe
C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
1⤵
PID:3848

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2888

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:2212
- C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\
  2⤵
  PID:3436
- - C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\
    3⤵
    PID:2380
- C:\Program Files\VideoLAN\VLC\locale\ar\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\update.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:3872
- - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
    3⤵
    PID:1604
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
  2⤵
  PID:1140
- - C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
    3⤵
    PID:3628
- C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
  2⤵
  PID:4528
- C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
  2⤵
  PID:1368
- C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
  2⤵
  PID:4848
- - C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
    3⤵
    PID:4112
- C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
  2⤵
  PID:2852
- C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
  2⤵
  PID:4828
- - C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
    3⤵
    PID:3124
- C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
  2⤵
  PID:4396
- - C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
    3⤵
    PID:3188
- C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\
  2⤵
  PID:1264
- - C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\
    3⤵
    PID:3232
- C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
  2⤵
  PID:5044
- C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
  2⤵
  PID:1808
- C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
  2⤵
  PID:2340
- C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
  2⤵
  PID:4396
- C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ie\
  2⤵
  PID:4560
- - C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\
    3⤵
    PID:2164
- C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
  2⤵
  PID:1332
- C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
  2⤵
  PID:4948
- C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
  2⤵
  PID:4088
- C:\Program Files\VideoLAN\VLC\locale\lo\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lo\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lo\
  2⤵
  PID:840
- C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
  2⤵
  PID:1232
- - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
    3⤵
    PID:1636
- C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
  2⤵
  PID:5032
- C:\Program Files\VideoLAN\VLC\locale\sm\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sm\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sm\
  2⤵
  PID:5044
- - C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\
    3⤵
    PID:3368

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\
1⤵
PID:212

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\
1⤵
PID:4444

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\
1⤵
PID:1620

C:\Windows\apppatch\ja-JP\backup.exe
C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
1⤵
PID:1416

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\
1⤵
PID:3472

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
1⤵
PID:4396

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\
1⤵
PID:2616

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\
1⤵
PID:4456

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4828

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\
1⤵
PID:3736

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\
1⤵
PID:4948

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
1⤵
PID:4444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\
1⤵
PID:3368

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4392

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\data.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\
1⤵
PID:752

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\
1⤵
PID:1168

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:4528

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\
1⤵
PID:4260
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\
  2⤵
  PID:1636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\
1⤵
PID:816

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:2548

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
1⤵
PID:1424

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
1⤵
PID:3200

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\
1⤵
PID:3976

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\
1⤵
PID:4512

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
1⤵
PID:1496

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:3440

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:2384

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\
1⤵
PID:4580

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:2160

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\
1⤵
PID:408

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:5012

C:\Program Files (x86)\Common Files\Oracle\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\
1⤵
PID:4396
- C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\
  2⤵
  PID:1232
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\System Restore.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\System Restore.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\
    3⤵
    PID:1436

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
1⤵
PID:3044
- C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\
1⤵
PID:4684

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
1⤵
PID:624

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\
1⤵
PID:3292

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\
1⤵
PID:4640

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
1⤵
PID:1764

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\
1⤵
PID:608

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\
1⤵
PID:4680
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\
  2⤵
  PID:5056

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\
1⤵
PID:2380

C:\Program Files (x86)\Common Files\System\ado\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
1⤵
PID:3632
- C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
  2⤵
  PID:744
- C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
  2⤵
  PID:4348

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:2160

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
1⤵
PID:3668

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\
1⤵
PID:692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\
1⤵
PID:1428

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
1⤵
PID:4636

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3840

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\
1⤵
PID:636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\
1⤵
PID:4944

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\
1⤵
PID:4820

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:4460

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\
1⤵
PID:4600

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\
1⤵
PID:692

C:\Program Files (x86)\Common Files\System\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
1⤵
PID:1360

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
1⤵
PID:2888

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\
1⤵
PID:2824

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\
1⤵
PID:840
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\
  2⤵
  PID:3792
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\update.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\
  2⤵
  PID:5084

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:1232

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
1⤵
PID:3956

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1020

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\
1⤵
PID:3184
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\
  2⤵
  PID:3616

C:\Windows\assembly\GAC_32\System.Data\backup.exe
C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:1808

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
1⤵
PID:3088

C:\Program Files (x86)\Common Files\System\msadc\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
1⤵
PID:1140
- C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
  2⤵
  PID:4684
- C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\
  2⤵
  PID:4196

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:3256
- C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:4728

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\
1⤵
PID:2584

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\
1⤵
PID:2312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\
1⤵
PID:5044
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\
  2⤵
  PID:3784
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\
  2⤵
  PID:4688
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\
  2⤵
  PID:2220
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\
  2⤵
  PID:1980

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\
1⤵
PID:3484

C:\Windows\assembly\GAC_32\System.Printing\System Restore.exe
"C:\Windows\assembly\GAC_32\System.Printing\System Restore.exe" C:\Windows\assembly\GAC_32\System.Printing\
1⤵
PID:60
- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:3612

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:3912

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\
1⤵
PID:4588
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\
  2⤵
  PID:2160

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
1⤵
PID:2120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\
1⤵
PID:4192

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
1⤵
PID:744

C:\Windows\assembly\GAC_32\System.Web\data.exe
C:\Windows\assembly\GAC_32\System.Web\data.exe C:\Windows\assembly\GAC_32\System.Web\
1⤵
PID:3376
- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4460

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\
1⤵
PID:4520

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\update.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\update.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\
1⤵
PID:3616

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:608
- C:\Program Files (x86)\Google\Temp\backup.exe
  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
  2⤵
  PID:3112
- C:\Program Files (x86)\Google\Update\backup.exe
  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
  2⤵
  PID:4260
- - C:\Program Files (x86)\Google\Update\Download\backup.exe
    "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
    3⤵
    PID:4636
- - C:\Program Files (x86)\Google\Update\Offline\backup.exe
    "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
    3⤵
    PID:4800

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\
1⤵
PID:1604

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\
1⤵
PID:668
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\
  2⤵
  PID:716
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\
    3⤵
    PID:2892
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\
      4⤵
      PID:3852

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
1⤵
PID:3984

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\
1⤵
PID:2160
- C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4828

C:\Windows\assembly\GAC_64\Microsoft.Ink\data.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\data.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
1⤵
PID:3184
- C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:3596

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
1⤵
PID:4480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\
1⤵
PID:928

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:452

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\
1⤵
PID:3976
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\
  2⤵
  PID:2380
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\
  2⤵
  PID:3796

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\
1⤵
PID:3880

C:\Program Files (x86)\Internet Explorer\backup.exe
"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
1⤵
PID:3044
- C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
  "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
  2⤵
  PID:4820
- C:\Program Files (x86)\Internet Explorer\en-US\System Restore.exe
  "C:\Program Files (x86)\Internet Explorer\en-US\System Restore.exe" C:\Program Files (x86)\Internet Explorer\en-US\
  2⤵
  PID:4392
- C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
  "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
  2⤵
  PID:4144
- C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
  "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
  2⤵
  PID:4360
- C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe
  "C:\Program Files (x86)\Internet Explorer\uk-UA\backup.exe" C:\Program Files (x86)\Internet Explorer\uk-UA\
  2⤵
  PID:4248

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:4688

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:4088

C:\Windows\assembly\GAC_64\mscorlib\backup.exe
C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\
1⤵
PID:5036

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\
1⤵
PID:1780

C:\Windows\assembly\GAC_64\srmlib\data.exe
C:\Windows\assembly\GAC_64\srmlib\data.exe C:\Windows\assembly\GAC_64\srmlib\
1⤵
PID:3848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\
1⤵
PID:1980

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
1⤵
PID:1228

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\
1⤵
PID:3432

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\
1⤵
PID:4992

C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
1⤵
PID:4848
- C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:1548

C:\Windows\assembly\GAC_64\System.EnterpriseServices\update.exe
C:\Windows\assembly\GAC_64\System.EnterpriseServices\update.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\
1⤵
PID:2228

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
1⤵
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
  2⤵
  PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
    3⤵
    PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\System Restore.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\
  2⤵
  PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\
    3⤵
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\backup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\
      4⤵
      PID:1744

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\
1⤵
PID:2696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\
1⤵
PID:4708

C:\Windows\assembly\GAC_64\System.Printing\backup.exe
C:\Windows\assembly\GAC_64\System.Printing\backup.exe C:\Windows\assembly\GAC_64\System.Printing\
1⤵
PID:5088
- C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:3368

C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
1⤵
PID:2424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\
1⤵
PID:1020

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\data.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\data.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\
1⤵
PID:3376

C:\Windows\assembly\GAC_64\System.Transactions\update.exe
C:\Windows\assembly\GAC_64\System.Transactions\update.exe C:\Windows\assembly\GAC_64\System.Transactions\
1⤵
PID:3920
- C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:4088

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\
1⤵
PID:3112

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\
1⤵
PID:2896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\
1⤵
PID:3380

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
1⤵
PID:3352

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\
1⤵
PID:988

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3872

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:1512
- C:\Program Files\Windows Defender\en-US\backup.exe
  "C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
  2⤵
  PID:3960
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:2856
- C:\Program Files\Windows Defender\uk-UA\backup.exe
  "C:\Program Files\Windows Defender\uk-UA\backup.exe" C:\Program Files\Windows Defender\uk-UA\
  2⤵
  PID:4576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\
1⤵
PID:3652

C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\
1⤵
PID:512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\
1⤵
PID:4608

C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
1⤵
PID:860
- C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
  2⤵
  PID:3188
- C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
  2⤵
  PID:4500

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\
1⤵
PID:692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\
1⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\
1⤵
PID:2040

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\
1⤵
PID:4468

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:4680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\
1⤵
PID:944

C:\Windows\Branding\Basebrd\de-DE\backup.exe
C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\
1⤵
PID:2424

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\
1⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\
1⤵
PID:1744

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:2516

C:\Windows\Branding\Basebrd\es-ES\backup.exe
C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\
1⤵
PID:4992

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\
1⤵
PID:2816

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\
1⤵
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\
  2⤵
  PID:4380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\
1⤵
PID:716

C:\Windows\Branding\Basebrd\it-IT\backup.exe
C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
1⤵
PID:4536

C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\
1⤵
PID:4468

C:\Windows\Containers\serviced\backup.exe
C:\Windows\Containers\serviced\backup.exe C:\Windows\Containers\serviced\
1⤵
PID:3784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\
1⤵
PID:3412

C:\Program Files\VideoLAN\VLC\plugins\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
1⤵
PID:1524
- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
  2⤵
  PID:1416
- C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
  2⤵
  PID:3088
- C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
  2⤵
  PID:2696
- C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
  2⤵
  PID:512
- C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\meta_engine\
  2⤵
  PID:2160
- C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
  2⤵
  PID:4684
- C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\text_renderer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\text_renderer\
  2⤵
  PID:884
- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_chroma\
  2⤵
  PID:5036
- C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
  2⤵
  PID:1480
- C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_output\
  2⤵
  PID:4628
- C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_splitter\
  2⤵
  PID:4592
- C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\visualization\
  2⤵
  PID:4892

C:\Program Files\Windows Media Player\Visualizations\backup.exe
"C:\Program Files\Windows Media Player\Visualizations\backup.exe" C:\Program Files\Windows Media Player\Visualizations\
1⤵
PID:1292

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\
1⤵
PID:1368
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\
  2⤵
  PID:4252
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\
    3⤵
    PID:1208
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\
      4⤵
      PID:1816

C:\Program Files\Windows NT\Accessories\backup.exe
"C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
1⤵
PID:2332
- C:\Program Files\Windows NT\Accessories\en-US\backup.exe
  "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
  2⤵
  PID:412

C:\Windows\DiagTrack\Scenarios\backup.exe
C:\Windows\DiagTrack\Scenarios\backup.exe C:\Windows\DiagTrack\Scenarios\
1⤵
PID:4536

C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\
1⤵
PID:3784

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:4848

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:3596

C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
1⤵
PID:4368

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2896

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\data.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\data.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\
1⤵
PID:4852

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4684

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\
1⤵
PID:3380

C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
"C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
1⤵
PID:4756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\
1⤵
PID:3188

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:4360

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\
1⤵
PID:2600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\
1⤵
PID:3792

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:2544

C:\Windows\Help\Help\backup.exe
C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
1⤵
PID:2380

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\
1⤵
PID:2228

C:\Program Files (x86)\MSBuild\update.exe
"C:\Program Files (x86)\MSBuild\update.exe" C:\Program Files (x86)\MSBuild\
1⤵
PID:692

C:\Windows\Help\mui\backup.exe
C:\Windows\Help\mui\backup.exe C:\Windows\Help\mui\
1⤵
PID:1832
- C:\Windows\Help\mui\0C0A\backup.exe
  C:\Windows\Help\mui\0C0A\backup.exe C:\Windows\Help\mui\0C0A\
  2⤵
  PID:4852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\
1⤵
PID:1036

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\
1⤵
PID:4408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\
1⤵
PID:1424

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
1⤵
PID:4660

C:\Program Files (x86)\Reference Assemblies\System Restore.exe
"C:\Program Files (x86)\Reference Assemblies\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:3268

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\
1⤵
PID:4564

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\
1⤵
PID:1136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\
1⤵
PID:740

C:\Program Files\VideoLAN\VLC\skins\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
1⤵
PID:5100

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\
1⤵
PID:4464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\
1⤵
PID:4500

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
1⤵
PID:3720

C:\Windows\Help\Windows\ContentStore\en-US\backup.exe
C:\Windows\Help\Windows\ContentStore\en-US\backup.exe C:\Windows\Help\Windows\ContentStore\en-US\
1⤵
PID:3184

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
1⤵
PID:3852
- C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\
  2⤵
  PID:2632
- - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\
    3⤵
    PID:2548

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:608
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\
  2⤵
  PID:4536
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\data.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\data.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\
  2⤵
  PID:4468
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:4692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\
1⤵
PID:2688

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:4972

C:\Windows\IdentityCRL\INT\update.exe
C:\Windows\IdentityCRL\INT\update.exe C:\Windows\IdentityCRL\INT\
1⤵
PID:4652

C:\Windows\IdentityCRL\production\backup.exe
C:\Windows\IdentityCRL\production\backup.exe C:\Windows\IdentityCRL\production\
1⤵
PID:4628

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\
1⤵
PID:1536
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4248

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\
1⤵
PID:3656

C:\Windows\IME\de-DE\backup.exe
C:\Windows\IME\de-DE\backup.exe C:\Windows\IME\de-DE\
1⤵
PID:3052

C:\Windows\IME\en-US\backup.exe
C:\Windows\IME\en-US\backup.exe C:\Windows\IME\en-US\
1⤵
PID:1876

C:\Windows\IME\fr-FR\backup.exe
C:\Windows\IME\fr-FR\backup.exe C:\Windows\IME\fr-FR\
1⤵
PID:3448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\
1⤵
PID:3596

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:3484

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\
1⤵
PID:4684

C:\Windows\IME\IMEJP\backup.exe
C:\Windows\IME\IMEJP\backup.exe C:\Windows\IME\IMEJP\
1⤵
PID:2816
- C:\Windows\IME\IMEJP\Assets\backup.exe
  C:\Windows\IME\IMEJP\Assets\backup.exe C:\Windows\IME\IMEJP\Assets\
  2⤵
  PID:3240

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:4688

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:4448

C:\Program Files (x86)\Windows Defender\backup.exe
"C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\
1⤵
PID:4628
- C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\
  2⤵
  PID:4280

C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
1⤵
PID:4312

C:\Windows\IME\IMEKR\backup.exe
C:\Windows\IME\IMEKR\backup.exe C:\Windows\IME\IMEKR\
1⤵
PID:2776
- C:\Windows\IME\IMEKR\DICTS\backup.exe
  C:\Windows\IME\IMEKR\DICTS\backup.exe C:\Windows\IME\IMEKR\DICTS\
  2⤵
  PID:1832
- C:\Windows\IME\IMEKR\HELP\backup.exe
  C:\Windows\IME\IMEKR\HELP\backup.exe C:\Windows\IME\IMEKR\HELP\
  2⤵
  PID:1780

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
1⤵
PID:4692

C:\Windows\IME\IMETC\backup.exe
C:\Windows\IME\IMETC\backup.exe C:\Windows\IME\IMETC\
1⤵
PID:2080
- C:\Windows\IME\IMETC\DICTS\backup.exe
  C:\Windows\IME\IMETC\DICTS\backup.exe C:\Windows\IME\IMETC\DICTS\
  2⤵
  PID:4536
- C:\Windows\IME\IMETC\HELP\backup.exe
  C:\Windows\IME\IMETC\HELP\backup.exe C:\Windows\IME\IMETC\HELP\
  2⤵
  PID:4408

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:4500

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\
1⤵
PID:3256

C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe
"C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
1⤵
PID:2616

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\
1⤵
PID:4092

C:\Program Files (x86)\Windows Media Player\en-US\backup.exe
"C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\
1⤵
PID:752

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:4432

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\
1⤵
PID:3720

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\
1⤵
PID:2852

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:2584

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\
1⤵
PID:4356

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\
1⤵
PID:3240

C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe
"C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\
1⤵
PID:4532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\
1⤵
PID:4272

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
1⤵
PID:3440

C:\Program Files (x86)\Windows NT\Accessories\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\
1⤵
PID:3212
- C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\en-US\
  2⤵
  PID:1332

C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
1⤵
PID:3560

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\
1⤵
PID:3656

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:4480

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\
1⤵
PID:5088

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\data.exe
"C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\data.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\
1⤵
PID:1520

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\
1⤵
PID:1816
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:544

C:\Windows\INF\ESENT\0407\backup.exe
C:\Windows\INF\ESENT\0407\backup.exe C:\Windows\INF\ESENT\0407\
1⤵
PID:5048

C:\Windows\INF\ESENT\0409\data.exe
C:\Windows\INF\ESENT\0409\data.exe C:\Windows\INF\ESENT\0409\
1⤵
PID:2980

C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\ja-JP\
1⤵
PID:4640

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\
1⤵
PID:512

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\
1⤵
PID:3876

C:\Windows\INF\ESENT\0411\backup.exe
C:\Windows\INF\ESENT\0411\backup.exe C:\Windows\INF\ESENT\0411\
1⤵
PID:1044

C:\Program Files (x86)\WindowsPowerShell\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\backup.exe" C:\Program Files (x86)\WindowsPowerShell\
1⤵
PID:4972
- C:\Program Files (x86)\WindowsPowerShell\Modules\System Restore.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\System Restore.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\
  2⤵
  PID:1428
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\
    3⤵
    PID:3232

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
1⤵
PID:3628

C:\Windows\INF\LSM\0000\backup.exe
C:\Windows\INF\LSM\0000\backup.exe C:\Windows\INF\LSM\0000\
1⤵
PID:4348

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\
1⤵
PID:5080

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\
1⤵
PID:4408

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\
1⤵
PID:4448
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\
  2⤵
  PID:3988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\
1⤵
PID:1056

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:344
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:4700

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\
1⤵
PID:1892

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\
1⤵
PID:2956

C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\
1⤵
PID:1512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\
1⤵
PID:1292
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\
  2⤵
  PID:624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\
    3⤵
    PID:3408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\
    3⤵
    PID:3200
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\
    3⤵
    PID:3956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\
    3⤵
    PID:1036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\
    3⤵
    PID:4432
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\
    3⤵
    PID:816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\
    3⤵
    PID:4504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\
    3⤵
    PID:2560
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\
    3⤵
    PID:1208
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\
    3⤵
    PID:3552

C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\
1⤵
PID:2544

C:\Windows\INF\MSDTC\0407\backup.exe
C:\Windows\INF\MSDTC\0407\backup.exe C:\Windows\INF\MSDTC\0407\
1⤵
PID:3432

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:4820

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\
1⤵
PID:3624

C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\
1⤵
PID:3412
- C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\
  2⤵
  PID:2404

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\
1⤵
PID:1228
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\
  2⤵
  PID:3044

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\System Restore.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\System Restore.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\
1⤵
PID:3976

C:\Windows\INF\MSDTC\0411\System Restore.exe
"C:\Windows\INF\MSDTC\0411\System Restore.exe" C:\Windows\INF\MSDTC\0411\
1⤵
PID:1924

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\
1⤵
PID:5040
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:3680
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:1492

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\
1⤵
PID:2892
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\
  2⤵
  PID:1184

C:\Windows\INF\MSDTC\0C0A\backup.exe
C:\Windows\INF\MSDTC\0C0A\backup.exe C:\Windows\INF\MSDTC\0C0A\
1⤵
PID:3256

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\
1⤵
PID:1012

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\data.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\
1⤵
PID:4868

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\
1⤵
PID:4932
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\
  2⤵
  PID:3644

C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\
1⤵
PID:2264

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\
1⤵
PID:2516

C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\data.exe
"C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\data.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\
1⤵
PID:2812

C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\backup.exe
"C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\
1⤵
PID:3040

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\
1⤵
PID:2980

C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\0000\
1⤵
PID:1424

C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\backup.exe
"C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\040C\
1⤵
PID:4464

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\
1⤵
PID:3596
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\
  2⤵
  PID:4120
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\
  2⤵
  PID:1264
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\
    3⤵
    PID:512
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\
    3⤵
    PID:1704
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\data.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\
    3⤵
    PID:4912

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:4088

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\update.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\
1⤵
PID:1148

C:\Windows\INF\PERFLIB\backup.exe
C:\Windows\INF\PERFLIB\backup.exe C:\Windows\INF\PERFLIB\
1⤵
PID:548
- C:\Windows\INF\PERFLIB\0000\backup.exe
  C:\Windows\INF\PERFLIB\0000\backup.exe C:\Windows\INF\PERFLIB\0000\
  2⤵
  PID:1528
- C:\Windows\INF\PERFLIB\0411\backup.exe
  C:\Windows\INF\PERFLIB\0411\backup.exe C:\Windows\INF\PERFLIB\0411\
  2⤵
  PID:5100
- C:\Windows\INF\PERFLIB\0C0A\data.exe
  C:\Windows\INF\PERFLIB\0C0A\data.exe C:\Windows\INF\PERFLIB\0C0A\
  2⤵
  PID:2236

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\
1⤵
PID:4852

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\
1⤵
PID:4932

C:\Windows\INF\PNRPSvc\0407\backup.exe
C:\Windows\INF\PNRPSvc\0407\backup.exe C:\Windows\INF\PNRPSvc\0407\
1⤵
PID:4820

C:\Windows\INF\PNRPSvc\0409\backup.exe
C:\Windows\INF\PNRPSvc\0409\backup.exe C:\Windows\INF\PNRPSvc\0409\
1⤵
PID:5036

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\
1⤵
PID:2696

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\
1⤵
PID:3448

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\
1⤵
PID:4520

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\
1⤵
PID:2748

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\
1⤵
PID:752
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\
  2⤵
  PID:4144

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:3440

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\
1⤵
PID:2040

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:1368

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\
1⤵
PID:2228

C:\Windows\INF\rdyboost\0410\backup.exe
C:\Windows\INF\rdyboost\0410\backup.exe C:\Windows\INF\rdyboost\0410\
1⤵
PID:512

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_es_b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_es_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4648

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\
1⤵
PID:1184
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\a193a57cfdcaa7baa4c9cd974badadb5\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\a193a57cfdcaa7baa4c9cd974badadb5\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\a193a57cfdcaa7baa4c9cd974badadb5\
  2⤵
  PID:1780

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:220

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:4112

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\
1⤵
PID:4312
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\
  2⤵
  PID:4640
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\
  2⤵
  PID:4508
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\
  2⤵
  PID:1424

C:\Windows\INF\RemoteAccess\0000\backup.exe
C:\Windows\INF\RemoteAccess\0000\backup.exe C:\Windows\INF\RemoteAccess\0000\
1⤵
PID:5028

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\28e8136efc0106917929dfc00d97eacd\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\28e8136efc0106917929dfc00d97eacd\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\28e8136efc0106917929dfc00d97eacd\
1⤵
PID:2548

C:\Windows\InputMethod\CHS\backup.exe
C:\Windows\InputMethod\CHS\backup.exe C:\Windows\InputMethod\CHS\
1⤵
PID:3128

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:4688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\
1⤵
PID:4248

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\
1⤵
PID:5012

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\
1⤵
PID:2080
- C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2784

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\
1⤵
PID:4880

C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\backup.exe
"C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\
1⤵
PID:2064
- C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\backup.exe
  "C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\backup.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\
  2⤵
  PID:1044
- C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0C0A\System Restore.exe
  "C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0C0A\System Restore.exe" C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0C0A\
  2⤵
  PID:3128

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\
1⤵
PID:4628

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\
1⤵
PID:2776

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\
1⤵
PID:4356

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\
1⤵
PID:4092

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\
1⤵
PID:2628

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\
1⤵
PID:2932

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\
1⤵
PID:3656

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:4660

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\
1⤵
PID:1208

C:\Windows\Microsoft.NET\assembly\backup.exe
C:\Windows\Microsoft.NET\assembly\backup.exe C:\Windows\Microsoft.NET\assembly\
1⤵
PID:408

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4#\802109be4d2ce39859ded54bbe541811\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4#\802109be4d2ce39859ded54bbe541811\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4#\802109be4d2ce39859ded54bbe541811\
1⤵
PID:4840

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\
1⤵
PID:1020

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:4236

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\35ac8b8f685e7b0a97d4c94c4df889ca\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\35ac8b8f685e7b0a97d4c94c4df889ca\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\35ac8b8f685e7b0a97d4c94c4df889ca\
1⤵
PID:2412

C:\Windows\INF\ServiceModelService 3.0.0.0\0409\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0409\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0409\
1⤵
PID:1480

C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\
1⤵
PID:3256

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:4712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\
1⤵
PID:3052

C:\Windows\INF\ServiceModelService 3.0.0.0\0410\backup.exe
"C:\Windows\INF\ServiceModelService 3.0.0.0\0410\backup.exe" C:\Windows\INF\ServiceModelService 3.0.0.0\0410\
1⤵
PID:464

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:4560

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:3088

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\
1⤵
PID:3044

C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\33ddd1d414c8f8d6deceff1a62363c2e\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\33ddd1d414c8f8d6deceff1a62363c2e\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\33ddd1d414c8f8d6deceff1a62363c2e\
1⤵
PID:4688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\
1⤵
PID:1620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\
1⤵
PID:3448

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2544

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\
1⤵
PID:4500

C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe
"C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\SMSvcHost 3.0.0.0\0C0A\
1⤵
PID:3292

C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe
"C:\Windows\INF\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\
1⤵
PID:1744
- C:\Windows\INF\SMSvcHost 4.0.0.0\0000\backup.exe
  "C:\Windows\INF\SMSvcHost 4.0.0.0\0000\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\0000\
  2⤵
  PID:116
- C:\Windows\INF\SMSvcHost 4.0.0.0\040C\System Restore.exe
  "C:\Windows\INF\SMSvcHost 4.0.0.0\040C\System Restore.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\040C\
  2⤵
  PID:1876
- C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe
  "C:\Windows\INF\SMSvcHost 4.0.0.0\0411\backup.exe" C:\Windows\INF\SMSvcHost 4.0.0.0\0411\
  2⤵
  PID:4684

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\
1⤵
PID:2264

C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\
1⤵
PID:4420

C:\Windows\INF\TAPISRV\0000\backup.exe
C:\Windows\INF\TAPISRV\0000\backup.exe C:\Windows\INF\TAPISRV\0000\
1⤵
PID:3212

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4236

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\
1⤵
PID:5112

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ab4e1169d06499b26dcd454f8e05b3a6\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ab4e1169d06499b26dcd454f8e05b3a6\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ab4e1169d06499b26dcd454f8e05b3a6\
1⤵
PID:1308

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\
1⤵
PID:4988

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\
1⤵
PID:1924

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\update.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\
1⤵
PID:3672

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\
1⤵
PID:5044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\
1⤵
PID:2304

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\
1⤵
PID:4120

C:\Windows\INF\TermService\040C\backup.exe
C:\Windows\INF\TermService\040C\backup.exe C:\Windows\INF\TermService\040C\
1⤵
PID:1140

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2264

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\
1⤵
PID:4464

C:\Windows\INF\TermService\0410\backup.exe
C:\Windows\INF\TermService\0410\backup.exe C:\Windows\INF\TermService\0410\
1⤵
PID:1436

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\data.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2228

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\
1⤵
PID:3384

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\
1⤵
PID:4192
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3852

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\3b83a5f5f3e7d4519ef1541797fb0868\
1⤵
PID:5040

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a0c4e776b9d01dd5fe5da7fd2edd1f6f\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a0c4e776b9d01dd5fe5da7fd2edd1f6f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a0c4e776b9d01dd5fe5da7fd2edd1f6f\
1⤵
PID:2856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\
1⤵
PID:4648

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:3872

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\445e1976593e6b3b2072e606af9be0ae\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\445e1976593e6b3b2072e606af9be0ae\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\445e1976593e6b3b2072e606af9be0ae\
1⤵
PID:4356

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1816

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4940

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\7dbb2a0aca626d77ea20c20c40f32e60\
1⤵
PID:1292

C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\
1⤵
PID:4520

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3560

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\
1⤵
PID:2852

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\
1⤵
PID:3668
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3124

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\
1⤵
PID:2236
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\285f79ebfbbdb039fc9607065b17587f\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\285f79ebfbbdb039fc9607065b17587f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\285f79ebfbbdb039fc9607065b17587f\
  2⤵
  PID:4648

C:\Windows\INF\UGatherer\0C0A\backup.exe
C:\Windows\INF\UGatherer\0C0A\backup.exe C:\Windows\INF\UGatherer\0C0A\
1⤵
PID:5040

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\
1⤵
PID:3916

C:\Windows\INF\UGTHRSVC\backup.exe
C:\Windows\INF\UGTHRSVC\backup.exe C:\Windows\INF\UGTHRSVC\
1⤵
PID:2148
- C:\Windows\INF\UGTHRSVC\0000\System Restore.exe
  "C:\Windows\INF\UGTHRSVC\0000\System Restore.exe" C:\Windows\INF\UGTHRSVC\0000\
  2⤵
  PID:1816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\
1⤵
PID:3628

C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\
1⤵
PID:3976

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\
1⤵
PID:3616

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2888

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1020

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1660

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\
1⤵
PID:4708

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2816

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:3412

C:\Windows\INF\usbhub\0407\backup.exe
C:\Windows\INF\usbhub\0407\backup.exe C:\Windows\INF\usbhub\0407\
1⤵
PID:1420

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands\
1⤵
PID:1980

C:\Windows\INF\usbhub\0411\backup.exe
C:\Windows\INF\usbhub\0411\backup.exe C:\Windows\INF\usbhub\0411\
1⤵
PID:3116

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4376

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\
1⤵
PID:512

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0000\
1⤵
PID:4144

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\update.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\update.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0407\
1⤵
PID:4808

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:4652

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\040C\
1⤵
PID:4564

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\
1⤵
PID:2212
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\
  2⤵
  PID:3656

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\
1⤵
PID:4612

C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0411\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0411\backup.exe" C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0411\
1⤵
PID:2652

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\
1⤵
PID:3916
- C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\v4.0_10.0.0.0__31bf3856ad364e35\
  2⤵
  PID:4928

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\4bbb283adecdf8a5bf110bc6786d021d\
1⤵
PID:3436

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1548

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\
1⤵
PID:3380

C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\040C\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\040C\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\040C\
1⤵
PID:2244

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:740

C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\backup.exe
"C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\backup.exe" C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\
1⤵
PID:4932

C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\
1⤵
PID:1248
- C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4612

C:\Windows\INF\WmiApRpl\0009\backup.exe
C:\Windows\INF\WmiApRpl\0009\backup.exe C:\Windows\INF\WmiApRpl\0009\
1⤵
PID:4468

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\
1⤵
PID:1624

C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:3232

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\update.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\
1⤵
PID:4848

C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\
1⤵
PID:3736

C:\Windows\INF\wsearchidxpi\0409\backup.exe
C:\Windows\INF\wsearchidxpi\0409\backup.exe C:\Windows\INF\wsearchidxpi\0409\
1⤵
PID:5024

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:740

C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:4544

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\
1⤵
PID:1436

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\
1⤵
PID:4464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\
1⤵
PID:3720

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\update.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\update.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:3052

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\
1⤵
PID:4092

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:4684

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\caebd127a3cf1487868f8d282898dcc1\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\caebd127a3cf1487868f8d282898dcc1\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\caebd127a3cf1487868f8d282898dcc1\
1⤵
PID:3916

C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1536

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\3ef04b2ab7a69aa8d90d3a62538479e4\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\3ef04b2ab7a69aa8d90d3a62538479e4\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\3ef04b2ab7a69aa8d90d3a62538479e4\
1⤵
PID:2244

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\
1⤵
PID:1428

C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\
1⤵
PID:716

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:4940

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\
1⤵
PID:1436
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\
  2⤵
  PID:4408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\
1⤵
PID:3656

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\
1⤵
PID:3368

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2616

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\
1⤵
PID:4348

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\
1⤵
PID:4972
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:928

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\
1⤵
PID:1012

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\
1⤵
PID:3040

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2852

C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:4272

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\
1⤵
PID:1148

C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\
1⤵
PID:5084

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\
1⤵
PID:636

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:3632

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\
1⤵
PID:1832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\
1⤵
PID:1668

C:\Windows\Microsoft.NET\authman\backup.exe
C:\Windows\Microsoft.NET\authman\backup.exe C:\Windows\Microsoft.NET\authman\
1⤵
PID:4508

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:740

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\
1⤵
PID:3960

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\
1⤵
PID:4972

C:\Windows\Microsoft.NET\Framework\3082\backup.exe
C:\Windows\Microsoft.NET\Framework\3082\backup.exe C:\Windows\Microsoft.NET\Framework\3082\
1⤵
PID:4984

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\
1⤵
PID:1604

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\a0e4dc4d7b18b0bcf31e3df2eef25553\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\a0e4dc4d7b18b0bcf31e3df2eef25553\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\a0e4dc4d7b18b0bcf31e3df2eef25553\
1⤵
PID:4480

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\data.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\f0f7f3b2fe4752faaf5a35d9c69daa14\
1⤵
PID:3192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\
1⤵
PID:4348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\backup.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\backup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\
1⤵
PID:2424

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.CertificateServices.PKIClient.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:2832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\
1⤵
PID:4852
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\
  2⤵
  PID:640

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\3ade3383a8d213683754d47634724bad\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\3ade3383a8d213683754d47634724bad\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\3ade3383a8d213683754d47634724bad\
1⤵
PID:4880

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\
1⤵
PID:960

C:\Windows\PLA\Reports\es-ES\backup.exe
C:\Windows\PLA\Reports\es-ES\backup.exe C:\Windows\PLA\Reports\es-ES\
1⤵
PID:5080

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\
1⤵
PID:1800

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\
1⤵
PID:1428

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\99a104ca107aaeb6a2f3d1c639ba47e6\
1⤵
PID:4756

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
3e20563e0af12aed591dd721154f3982

SHA1
ab64b7ac25e8eca46a4fc0951ad4f00631fa2304

SHA256
385b27de1e252b56c264e865566c3a37b2be0e163040663700161d9b13d26900

SHA512
d61d2399ea9938822675cc69ca86870384ffac99010d39040e51d364639f57013df3434909025e5033409e6437623c91588c33be3d90dfa6a056a56b808ca424

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
0f1286806e24ce64c69450706d99a90d

SHA1
828683bce533d894dbffd08164006628dbccb2f6

SHA256
6019b671e4e723dbdd94758c26a8580a08fe0d5b414930dd5f378821cf10870a

SHA512
99be2531a613a9c6783016df7898ce9ec4056095e69a8bd4459531e7831030113afea1776ff2e45f728429f8f41548e96aa1721a470d3b84338f01fb825b21c7

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
2a34c2a123413a2e2eeae6d67f4459f6

SHA1
4aafcf5d72f42182e3ca68fbd087ab22a7954cec

SHA256
5e9ff85c02cc035326992a6f09ed92d18976851e63cf3f978073b8eaecd13d8b

SHA512
733b0499d2a26cde8815e05fa8af03f99eff67e542ae8bed64a2461d7f973cbaedb6e4f5dd83f62de3846d4fd7f6e7f93776dd17a16694229c3e0d581528ce4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe

Filesize
72KB

MD5
605ef4380440084156d453e412553d55

SHA1
b36f1495575e75fa63717e4960a26a4ebb473aaf

SHA256
4711c65146b244be46c1864bbf0843afc292c78f32baee9ff6eaebbd6d7d1440

SHA512
5b1203f3e2d5cdea98e5f1f945b854ffcd9d41f6c6e9cc79ca1d696390b22b5dabef5dd4a0cfa27f9530e09f5e89fb7b1ebfb817e5209a6b4fd3f7ab7a61c73e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
72KB

MD5
96e5f6a3b60a5e08b8ed3632611a7699

SHA1
a3f4d1d9f226e582d77d6175dafe6b4ce7280e81

SHA256
30029f420b8304113afe819fe6449ef56a92aeb269a26424b32df77bb1162079

SHA512
b6e5dcceb64ff42e0c89c7164ab575a8d4e82018ddd5f285235ec02dc9771a8187e3c6d165ce43a7e7c734f933460c5844af546e75f31ac7f2b358e07ecd2701

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

Filesize
72KB

MD5
6a0fb446d5d9b31cdf553c87157e1ddf

SHA1
d0b1523155491317a770adbfa6682c5fb4f74940

SHA256
3ef2fe8e6ef1a84ac077c5689d83c5e89404dc2ed2b45c2d429479c5c8222153

SHA512
b3c0a7adeb22377e8c85177e6cd41b8a8de6828f7250573504b83375c04ceb8271f609859b9daf3610f1b2e3fcbd9d8bc364858bd90be1553f3214b875948a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
f3e467ab67fc5da86466130c24d0ce79

SHA1
ac30bd3889a86b2af200d57984f96a3bf926afac

SHA256
7ae359d5dba8fcfce49f19579f1f6d40cd9c6f50ea4694d3f0c25f684ae7124c

SHA512
16c07a314a2d992b512711e59a898faf07a618d2228724e9c0c99a340f6a0ef4fd0a39a8b0eef8330d70b1028246c00deb986393d52728dfd4d394a6e2a43dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

Filesize
72KB

MD5
6c6a4580f10c7ad7c21013ccb84d3d78

SHA1
6e0cc371d51a588d3fff85086b4814a3bbb766d7

SHA256
5438f6ac4d1b256395d97004694fe80e03c936029e20967854e0db89b0eb8c92

SHA512
2968072a6caf1920c75f6ab3a9dde014c4feda90276b7effd8506b9036cac21ac52608ea985f0f6ed9ceac23d248308be81a39beba539c8e964ad142f4c972c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
72KB

MD5
9a14838efc45d9cd0e8e233169e5a569

SHA1
fa097cdf3f8f32e4b3ff71475c53c015bb28de91

SHA256
0c1b8851739754442e34dea9a0d1e5c0f532f48d9332cd92c2bfd06aae101e54

SHA512
522a9220edffdb12cfad8d1afe5889658272c6e7b9b289760522665fe2f9d582930f6488f096e0e8fda3aa36e35cdbff64637c65421fca8dff7d3e08119ec882

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
40d071754dcf298d156af7330a9445f7

SHA1
bb6b7d6f5c834f48a566f319162e417a0411b133

SHA256
d679688732357b7f5dbe52f6c64f7252cba6c7875dc138554aa2210474b0ae4e

SHA512
89b91844f3e06e13cacd93b9cc31c3f4b85467e5d342a2289e19f3bf3cd86316cda8ed75165036f41c59d315581666ece159827358ae4de5f46bda14ee0a55f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B92826C1-EE11-4152-BB67-B6780B38D38B}\backup.exe

Filesize
72KB

MD5
52af31a03472b56cb292d3cc0dedfd98

SHA1
e364a226ef3894170b45f66f82f5b80b8570c380

SHA256
b0922a51225529cb420aefad88f195674331af0762bb80690e4a8af994b2f947

SHA512
3f8f6e057d35f4458965ddc62dbe7967899e404109409159d0bc8e1e96c491706667ed35603e017260dd4e5d2962c53b9e895cfacde56ff85dbc90a277713b15

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads