38f2b22691cc59407ded75f520616bd182b857e060804261cd12a6ed84d3c36b

Analysis

max time kernel
90s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

435a99986f2af2395b8178c27f621300_NeikiAnalytics.exe
Size

72KB
MD5

435a99986f2af2395b8178c27f621300
SHA1

68be43518d26f31faa1a8cc2fcf895e2c008a00e
SHA256

38f2b22691cc59407ded75f520616bd182b857e060804261cd12a6ed84d3c36b
SHA512

2d67d9102133ea37c96e01586a6d162490736f78b5546f9a56fc85bec3856bae1579beaf5881b455706aa17dc413c538c018d4a3c0bf70a6e5a3f1604e25bbe7
SSDEEP

768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd/+I91:HeT7BVwxfvqguKp+S1

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\435a99986f2af2395b8178c27f621300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\435a99986f2af2395b8178c27f621300_NeikiAnalytics.exe"
1⤵
PID:2968
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2556

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:2236

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
1⤵
PID:3012

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:1540

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:3016

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:2384
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:2220
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
  2⤵
  PID:800
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
  2⤵
  PID:1736
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:1596

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2568

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2496

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2720

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:1956

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
1⤵
PID:1552

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
1⤵
PID:1772

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
1⤵
PID:2260

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:2780

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:2376

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:3008
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\update.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:1384
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
  2⤵
  PID:1484

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
1⤵
PID:2980

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:1492

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:876
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:1592
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:2632
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:2428

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2620
- C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
  2⤵
  PID:2908
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:1964
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:2540

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:2664

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:2776

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:1816

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\update.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\update.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:2608

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:1516

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:2100
- C:\Program Files\Common Files\System\ado\de-DE\backup.exe
  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
  2⤵
  PID:2104
- C:\Program Files\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
  2⤵
  PID:1524
- C:\Program Files\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
  2⤵
  PID:1640
- C:\Program Files\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:1224
- C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe
  "C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\
  2⤵
  PID:376

C:\Program Files\Common Files\System\es-ES\backup.exe
"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
1⤵
PID:2256

C:\Program Files\Common Files\System\fr-FR\backup.exe
"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
1⤵
PID:1384

C:\Program Files\Common Files\System\it-IT\backup.exe
"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
1⤵
PID:1140

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:656
- C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
  "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
  2⤵
  PID:1720
- C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
  2⤵
  PID:1492

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:3044

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2476

C:\Program Files\DVD Maker\it-IT\data.exe
"C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\
1⤵
PID:1924

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2664

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:2348

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
1⤵
PID:1312

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
1⤵
PID:1628

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
1⤵
PID:2260

C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
1⤵
PID:664

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
1⤵
PID:536

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
1⤵
PID:2772

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
1⤵
PID:2460

C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
1⤵
PID:1348

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
1⤵
PID:2180

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:304

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:2188

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:3024

C:\Program Files\Internet Explorer\de-DE\data.exe
"C:\Program Files\Internet Explorer\de-DE\data.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:2116

C:\Program Files\Internet Explorer\fr-FR\backup.exe
"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
1⤵
PID:2680

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:3004

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
1⤵
PID:2604

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:1084

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
1⤵
PID:2744

C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
1⤵
PID:2660

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
1⤵
PID:476

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:2372

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:2032

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
1⤵
PID:1680

C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
1⤵
PID:1364

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:740

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
1⤵
PID:2776

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
1⤵
PID:980

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
1⤵
PID:2088

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
1⤵
PID:1588
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
  2⤵
  PID:2156
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
  2⤵
  PID:1996
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
  2⤵
  PID:2592
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
  2⤵
  PID:2268
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
  2⤵
  PID:2496
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
  2⤵
  PID:2716

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
1⤵
PID:2728

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
1⤵
PID:2552

C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
1⤵
PID:1776

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:2668
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
  2⤵
  PID:1652

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:2904
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
  2⤵
  PID:2660
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
  2⤵
  PID:2932
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:2988
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:1544
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:2448
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:2208
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:868
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:3028
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:2884
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
  2⤵
  PID:2560
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:2632
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:2908
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:2648
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:2480
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
    3⤵
    PID:2740

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2192

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:3024

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:896

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
1⤵
PID:1980
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
  2⤵
  PID:2916
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
    3⤵
    PID:1332

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:1732
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
  2⤵
  PID:1744

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:2888
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
  2⤵
  PID:2304
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
    3⤵
    PID:2336
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
      4⤵
      PID:2788
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
        5⤵
        
        PID:2140
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
        5⤵
        
        PID:2436
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
    3⤵
    PID:1128
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
  2⤵
  PID:1764
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
    3⤵
    PID:780
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:760
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:1988
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
    3⤵
    PID:748
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
      4⤵
      PID:2448
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
    3⤵
    PID:1424
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
    3⤵
    PID:1504

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:1724

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
1⤵
PID:2884
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
  2⤵
  PID:2732

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:2512

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
1⤵
PID:304

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
1⤵
PID:2116

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
1⤵
PID:2972

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
1⤵
PID:2896

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
1⤵
PID:468

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
1⤵
PID:2348

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:1848
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
  2⤵
  PID:1772

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2828

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
1⤵
PID:1568
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
  2⤵
  PID:2140

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:2436
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
  2⤵
  PID:1656

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:880

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
1⤵
PID:1576

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
1⤵
PID:1348

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:620
- C:\Program Files\Java\jre7\bin\plugin2\data.exe
  "C:\Program Files\Java\jre7\bin\plugin2\data.exe" C:\Program Files\Java\jre7\bin\plugin2\
  2⤵
  PID:2016

C:\Program Files\Java\jre7\lib\backup.exe
"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
1⤵
PID:1676
- C:\Program Files\Java\jre7\lib\cmm\backup.exe
  "C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
  2⤵
  PID:2844
- C:\Program Files\Java\jre7\lib\deploy\backup.exe
  "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
  2⤵
  PID:2120
- C:\Program Files\Java\jre7\lib\images\backup.exe
  "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
  2⤵
  PID:2552
- C:\Program Files\Java\jre7\lib\jfr\backup.exe
  "C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
  2⤵
  PID:3000
- C:\Program Files\Java\jre7\lib\security\backup.exe
  "C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
  2⤵
  PID:2420
- C:\Program Files\Java\jre7\lib\zi\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
  2⤵
  PID:2580
- - C:\Program Files\Java\jre7\lib\zi\America\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
    3⤵
    PID:2540
  - - C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
      4⤵
      PID:2496
  - - C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\update.exe
      "C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\update.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
      4⤵
      PID:3064
- - C:\Program Files\Java\jre7\lib\zi\Antarctica\update.exe
    "C:\Program Files\Java\jre7\lib\zi\Antarctica\update.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
    3⤵
    PID:548
- - C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
    3⤵
    PID:1052
- - C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
    3⤵
    PID:1552

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:2100

C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
1⤵
PID:2256

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
1⤵
PID:2388

C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
1⤵
PID:3008

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
1⤵
PID:2868

C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
1⤵
PID:2512

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:2648

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
1⤵
PID:1772

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
1⤵
PID:2828
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
  2⤵
  PID:2596

C:\Program Files\Microsoft Games\Mahjong\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:2660
- C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
  2⤵
  PID:2152

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:832

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:2120

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
1⤵
PID:3024

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:1668

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
1⤵
PID:2328

C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
"C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
1⤵
PID:3020

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:1648
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
  2⤵
  PID:1084

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2376

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2876

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
1⤵
PID:2732

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
1⤵
PID:2688

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:2156
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
  2⤵
  PID:1380
- C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
  2⤵
  PID:1840
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
    3⤵
    PID:1764
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
    3⤵
    PID:1976
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
    3⤵
    PID:2320
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
    3⤵
    PID:1724
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
    3⤵
    PID:1768
- C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
  2⤵
  PID:2400
- C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
  2⤵
  PID:1768
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\
    3⤵
    PID:896
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\
    3⤵
    PID:2452

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:1928

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\System Restore.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
1⤵
PID:1044

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
1⤵
PID:1552

C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
1⤵
PID:1644

C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
1⤵
PID:2732

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:2536

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
1⤵
PID:2972

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2288
- C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe
  "C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe" C:\Program Files\Microsoft Office\Office14\1033\
  2⤵
  PID:2372

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
1⤵
PID:1232

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:2092

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
1⤵
PID:3000

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
1⤵
PID:2540
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
  2⤵
  PID:1076

C:\Program Files\Reference Assemblies\Microsoft\update.exe
"C:\Program Files\Reference Assemblies\Microsoft\update.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:1652

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:3036

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:296
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:2308
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
  2⤵
  PID:2844
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
  2⤵
  PID:3044

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:2700

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
1⤵
PID:2456

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:1740
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:2404
- C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:1568
- C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
  2⤵
  PID:1728
- C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
  2⤵
  PID:644
- C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
  2⤵
  PID:2744
- C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
  2⤵
  PID:2604
- C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
  2⤵
  PID:476
- C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
  2⤵
  PID:2876
- C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
  2⤵
  PID:1684
- C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
  2⤵
  PID:2748
- C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
  2⤵
  PID:1520
- C:\Program Files\VideoLAN\VLC\locale\th\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\th\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\
  2⤵
  PID:1804
- C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
  2⤵
  PID:1272

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
1⤵
PID:1840

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
1⤵
PID:2884

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
1⤵
PID:320

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
1⤵
PID:2208

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
1⤵
PID:1276

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
1⤵
PID:1652

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
1⤵
PID:2096

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:1580

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:1620

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
1⤵
PID:1480

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
1⤵
PID:2392

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
1⤵
PID:576

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:952

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
1⤵
PID:1492

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
1⤵
PID:1616

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
1⤵
PID:620

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
1⤵
PID:2880

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
1⤵
PID:1692

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
1⤵
PID:2096

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
1⤵
PID:1380

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:1708

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:2444

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
1⤵
PID:1592

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
1⤵
PID:2564

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:1704

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:2688

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
1⤵
PID:2520

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
1⤵
PID:1520

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
1⤵
PID:684

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
1⤵
PID:1292

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
1⤵
PID:2152

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:1896

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
1⤵
PID:808

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\
1⤵
PID:1616

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:2876

C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
1⤵
PID:1504

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:2420

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
1⤵
PID:700

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
1⤵
PID:1904

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
1⤵
PID:2984

C:\Program Files (x86)\Common Files\System\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
1⤵
PID:2348

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:1028

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
1⤵
PID:880

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
1⤵
PID:2436

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\
1⤵
PID:1764

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe
"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\
1⤵
PID:2704

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
1⤵
PID:3060

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
1⤵
PID:3016

C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
1⤵
PID:2688

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:2148
- C:\Program Files (x86)\Google\Temp\backup.exe
  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
  2⤵
  PID:2676

C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
1⤵
PID:536

C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
1⤵
PID:272

C:\Program Files (x86)\Internet Explorer\backup.exe
"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
1⤵
PID:2784
- C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
  "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
  2⤵
  PID:2696
- C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
  "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
  2⤵
  PID:2456

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:2320

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
1⤵
PID:1516

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
1⤵
PID:1312

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\
1⤵
PID:1924

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
1⤵
PID:2308

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\data.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\data.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
1⤵
PID:1764

C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe
"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\
1⤵
PID:2876
- C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe
  "C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\
  2⤵
  PID:2464

C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
1⤵
PID:2352

C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
1⤵
PID:2824

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\
1⤵
PID:2788

C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
1⤵
PID:2220

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:2108

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\
1⤵
PID:376

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
1⤵
PID:1928

C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
1⤵
PID:1116

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\
1⤵
PID:1596

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:2392

C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\
1⤵
PID:2460

C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
1⤵
PID:2472
- C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
  2⤵
  PID:2752

C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\
1⤵
PID:2536

C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
1⤵
PID:1540

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\
1⤵
PID:272

C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
1⤵
PID:740

C:\Users\Admin\data.exe
C:\Users\Admin\data.exe C:\Users\Admin\
1⤵
PID:2640
- C:\Users\Admin\Desktop\backup.exe
  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
  2⤵
  PID:876
- C:\Users\Admin\Documents\backup.exe
  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
  2⤵
  PID:1424
- C:\Users\Admin\Music\backup.exe
  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
  2⤵
  PID:1040
- C:\Users\Admin\Pictures\backup.exe
  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
  2⤵
  PID:2648

C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\
1⤵
PID:2844

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:2064

C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
1⤵
PID:2732

C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
1⤵
PID:2568

C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
1⤵
PID:2404

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\
1⤵
PID:2304

C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
1⤵
PID:2372

C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
1⤵
PID:1496

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\
1⤵
PID:376

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\
1⤵
PID:3016

C:\Program Files\VideoLAN\VLC\plugins\gui\data.exe
"C:\Program Files\VideoLAN\VLC\plugins\gui\data.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
1⤵
PID:2496

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:1464

C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
1⤵
PID:1740

C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
1⤵
PID:1572

C:\Users\Public\Videos\data.exe
C:\Users\Public\Videos\data.exe C:\Users\Public\Videos\
1⤵
PID:1528
- C:\Users\Public\Videos\Sample Videos\backup.exe
  "C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
  2⤵
  PID:1964

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\
1⤵
PID:1676
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\
  2⤵
  PID:1072

C:\Windows\AppPatch\backup.exe
C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
1⤵
PID:1700
- C:\Windows\AppPatch\AppPatch64\backup.exe
  C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
  2⤵
  PID:980
- C:\Windows\AppPatch\Custom\update.exe
  C:\Windows\AppPatch\Custom\update.exe C:\Windows\AppPatch\Custom\
  2⤵
  PID:2264
- - C:\Windows\AppPatch\Custom\Custom64\backup.exe
    C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\
    3⤵
    PID:1004

C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\services_discovery\
1⤵
PID:2788

C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\stream_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_filter\
1⤵
PID:1724

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\
1⤵
PID:1424

C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_chroma\
1⤵
PID:2572

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\
1⤵
PID:2808

C:\Windows\assembly\GAC\ADODB\backup.exe
C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
1⤵
PID:1612

C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\visualization\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\visualization\
1⤵
PID:2472

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\
1⤵
PID:2776

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2964
- C:\Program Files\Windows Defender\ja-JP\update.exe
  "C:\Program Files\Windows Defender\ja-JP\update.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:2616

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\
1⤵
PID:2912

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
1⤵
PID:2492
- C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
  2⤵
  PID:1472

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\
1⤵
PID:1244
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\update.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\
  2⤵
  PID:2768

C:\Program Files\Windows Journal\en-US\backup.exe
"C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
1⤵
PID:2764

C:\Windows\assembly\GAC\stdole\update.exe
C:\Windows\assembly\GAC\stdole\update.exe C:\Windows\assembly\GAC\stdole\
1⤵
PID:536

C:\Program Files\Windows Journal\es-ES\backup.exe
"C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
1⤵
PID:2932

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\data.exe
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\data.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:2524

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2452

C:\Program Files\Windows Mail\es-ES\backup.exe
"C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
1⤵
PID:2784

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\
1⤵
PID:2932

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:2088

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1232

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2208

C:\Program Files\Windows Media Player\fr-FR\System Restore.exe
"C:\Program Files\Windows Media Player\fr-FR\System Restore.exe" C:\Program Files\Windows Media Player\fr-FR\
1⤵
PID:620

C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\
1⤵
PID:2564

C:\Program Files\Windows Media Player\Network Sharing\backup.exe
"C:\Program Files\Windows Media Player\Network Sharing\backup.exe" C:\Program Files\Windows Media Player\Network Sharing\
1⤵
PID:2748

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\
1⤵
PID:1936
- C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\
  2⤵
  PID:1748

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:1508

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2032

C:\Program Files\Windows NT\Accessories\backup.exe
"C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
1⤵
PID:356

C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\
1⤵
PID:1308

C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\
1⤵
PID:684

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
1⤵
PID:1924

C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\
1⤵
PID:1736

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
1⤵
PID:2444

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\
1⤵
PID:1188

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\
1⤵
PID:2452

C:\Program Files\Windows NT\TableTextService\en-US\backup.exe
"C:\Program Files\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files\Windows NT\TableTextService\en-US\
1⤵
PID:2736

C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\
1⤵
PID:1464

C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe
"C:\Program Files\Windows NT\TableTextService\fr-FR\backup.exe" C:\Program Files\Windows NT\TableTextService\fr-FR\
1⤵
PID:2300

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:2536
- C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
  "C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
  2⤵
  PID:1928

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\
1⤵
PID:760

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2640

C:\Program Files (x86)\Microsoft Office\Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\
1⤵
PID:1792
- C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\
  2⤵
  PID:2388

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:2888

C:\Program Files\Windows Sidebar\en-US\backup.exe
"C:\Program Files\Windows Sidebar\en-US\backup.exe" C:\Program Files\Windows Sidebar\en-US\
1⤵
PID:2324

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\
1⤵
PID:1932

C:\Windows\assembly\GAC_32\MSBuild\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:2492

C:\Windows\assembly\GAC_32\napcrypt\backup.exe
C:\Windows\assembly\GAC_32\napcrypt\backup.exe C:\Windows\assembly\GAC_32\napcrypt\
1⤵
PID:1544

C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1292

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
1⤵
PID:1640

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
1⤵
PID:2576

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
1⤵
PID:2092
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
  2⤵
  PID:1676
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
  2⤵
  PID:1076

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:880

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\
1⤵
PID:1736

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\update.exe
C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\update.exe C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:2776

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\
1⤵
PID:2528

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:2284

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2132

C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\
1⤵
PID:2596

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:1384
- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1768

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
1⤵
PID:2216

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\
1⤵
PID:2620
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\
  2⤵
  PID:2092
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\
  2⤵
  PID:2712
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
    3⤵
    PID:2496
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
    3⤵
    PID:2784
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\
  2⤵
  PID:2868
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\
    3⤵
    PID:684
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\
  2⤵
  PID:2612
- - C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\
    3⤵
    PID:3044
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\
  2⤵
  PID:2448
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
  2⤵
  PID:2560

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:2548

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\
1⤵
PID:772
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\
  2⤵
  PID:748

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2924

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\
1⤵
PID:2300
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\
  2⤵
  PID:548
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\
    3⤵
    PID:1616
- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\update.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\update.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\
  2⤵
  PID:2256
- - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\
    3⤵
    PID:1420

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
1⤵
PID:608

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
1⤵
PID:2568
- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2728

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\
1⤵
PID:2156

C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2228

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\
1⤵
PID:2980

C:\Windows\assembly\GAC_64\mcstoredb\backup.exe
C:\Windows\assembly\GAC_64\mcstoredb\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\
1⤵
PID:764
- C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2456

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\
1⤵
PID:2900

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
1⤵
PID:2288

C:\Windows\assembly\GAC_64\Mcx2Dvcs\backup.exe
C:\Windows\assembly\GAC_64\Mcx2Dvcs\backup.exe C:\Windows\assembly\GAC_64\Mcx2Dvcs\
1⤵
PID:644

C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
1⤵
PID:1304

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\
1⤵
PID:2928

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\
1⤵
PID:2676
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\
  2⤵
  PID:1964
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
  2⤵
  PID:700

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
1⤵
PID:760

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
1⤵
PID:800

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:448

C:\Program Files (x86)\Reference Assemblies\backup.exe
"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:2952

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\
1⤵
PID:2344
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
  2⤵
  PID:836

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:1668

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2332

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\
1⤵
PID:1244

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:3028

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\
1⤵
PID:2240
- C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\data.exe
  "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\data.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\
  2⤵
  PID:2308

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:1832

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
1⤵
PID:2528

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\data.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\data.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:2744
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:2808
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\
  2⤵
  PID:1964
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\
  2⤵
  PID:356

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:832

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\
1⤵
PID:2636
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
  2⤵
  PID:1376
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\
    3⤵
    PID:2612
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
  2⤵
  PID:1568
- - C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
    3⤵
    PID:2904

C:\Program Files (x86)\Windows Defender\de-DE\backup.exe
"C:\Program Files (x86)\Windows Defender\de-DE\backup.exe" C:\Program Files (x86)\Windows Defender\de-DE\
1⤵
PID:2496

C:\Program Files (x86)\Windows Defender\en-US\backup.exe
"C:\Program Files (x86)\Windows Defender\en-US\backup.exe" C:\Program Files (x86)\Windows Defender\en-US\
1⤵
PID:1096

C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
1⤵
PID:1928

C:\Program Files (x86)\Windows Mail\backup.exe
"C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\
1⤵
PID:924
- C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Mail\fr-FR\backup.exe" C:\Program Files (x86)\Windows Mail\fr-FR\
  2⤵
  PID:1844
- C:\Program Files (x86)\Windows Mail\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Mail\it-IT\backup.exe" C:\Program Files (x86)\Windows Mail\it-IT\
  2⤵
  PID:2688

C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1772

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\data.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\data.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2704

C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\
1⤵
PID:2520

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
1⤵
PID:2896

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\
1⤵
PID:3016
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\
  2⤵
  PID:840
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\
  2⤵
  PID:3028
- C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\
  2⤵
  PID:644

C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2424

C:\Windows\assembly\GAC_64\MSBuild\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\
1⤵
PID:2976
- C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2020

C:\Program Files (x86)\Windows Media Player\en-US\backup.exe
"C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\
1⤵
PID:2092

C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
"C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
1⤵
PID:2568

C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
1⤵
PID:476

C:\Windows\assembly\GAC_64\napcrypt\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\backup.exe C:\Windows\assembly\GAC_64\napcrypt\
1⤵
PID:304

C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2148

C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
"C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
1⤵
PID:984

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\
1⤵
PID:2932
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
  2⤵
  PID:3056

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\
1⤵
PID:880

C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe
"C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\
1⤵
PID:2444

C:\Program Files (x86)\Windows NT\Accessories\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\
1⤵
PID:1732
- C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\de-DE\
  2⤵
  PID:2132
- C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\en-US\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\en-US\
  2⤵
  PID:2908
- C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\it-IT\
  2⤵
  PID:1708

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\
1⤵
PID:2128
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
  2⤵
  PID:836

C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:1804

C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1748

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\
1⤵
PID:1048
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
  2⤵
  PID:2868

C:\Program Files (x86)\Windows NT\TableTextService\System Restore.exe
"C:\Program Files (x86)\Windows NT\TableTextService\System Restore.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:2876
- C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\de-DE\
  2⤵
  PID:1044
- C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\es-ES\
  2⤵
  PID:2660

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
1⤵
PID:1240

C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
1⤵
PID:2920

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\
1⤵
PID:2240

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\
1⤵
PID:880

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\update.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\
1⤵
PID:2672
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
  2⤵
  PID:2076

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:1764

C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\
1⤵
PID:1668

C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
1⤵
PID:2492

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\update.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
1⤵
PID:892

C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
1⤵
PID:1596

C:\Program Files (x86)\Windows Portable Devices\backup.exe
"C:\Program Files (x86)\Windows Portable Devices\backup.exe" C:\Program Files (x86)\Windows Portable Devices\
1⤵
PID:548

C:\Program Files (x86)\Windows Sidebar\backup.exe
"C:\Program Files (x86)\Windows Sidebar\backup.exe" C:\Program Files (x86)\Windows Sidebar\
1⤵
PID:2300
- C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\es-ES\
  2⤵
  PID:2472
- C:\Program Files (x86)\Windows Sidebar\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\fr-FR\
  2⤵
  PID:1924
- C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\it-IT\
  2⤵
  PID:2032

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe
C:\Windows\assembly\GAC_MSIL\ComSvcConfig\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\
1⤵
PID:2936
- C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2576

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\
1⤵
PID:2116

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
1⤵
PID:3036

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:644

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\
1⤵
PID:1504

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:2832

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\
1⤵
PID:2172

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\
1⤵
PID:1804
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\data.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
  2⤵
  PID:1996

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:1508

C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2376

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\
1⤵
PID:576
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\
  2⤵
  PID:1384
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\System Restore.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
  2⤵
  PID:1572

C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\
1⤵
PID:468
- C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1936

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\
1⤵
PID:2568
- C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\
  2⤵
  PID:1276

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\
1⤵
PID:904
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\
  2⤵
  PID:2480
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
  2⤵
  PID:1736

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\
1⤵
PID:344

C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiiTV\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\
1⤵
PID:2780
- C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2524

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\
1⤵
PID:2680

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\
1⤵
PID:2624

C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2452

C:\Windows\assembly\GAC_MSIL\ehiUserXp\data.exe
C:\Windows\assembly\GAC_MSIL\ehiUserXp\data.exe C:\Windows\assembly\GAC_MSIL\ehiUserXp\
1⤵
PID:2824
- C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1232

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:952

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
1⤵
PID:2128

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\
1⤵
PID:296

C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\
1⤵
PID:344

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\
1⤵
PID:2224

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:2192

C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe
C:\Windows\assembly\GAC_MSIL\ehshell\backup.exe C:\Windows\assembly\GAC_MSIL\ehshell\
1⤵
PID:1756

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\
1⤵
PID:2836

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\
1⤵
PID:1844
- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:1620
- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:1276

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\
1⤵
PID:2496

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\
1⤵
PID:2952

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\
1⤵
PID:2600
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\
  2⤵
  PID:2416

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
1⤵
PID:1792

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\
1⤵
PID:2480

C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2676

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\
1⤵
PID:2460
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\
  2⤵
  PID:2124
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
  2⤵
  PID:2656

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\
1⤵
PID:880
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\data.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
  2⤵
  PID:876

C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2172

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\
1⤵
PID:656

C:\Windows\assembly\GAC_MSIL\loadmxf\backup.exe
C:\Windows\assembly\GAC_MSIL\loadmxf\backup.exe C:\Windows\assembly\GAC_MSIL\loadmxf\
1⤵
PID:2396
- C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:548

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\
1⤵
PID:2604

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:1264

C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe
C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\
1⤵
PID:468

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\
1⤵
PID:2788

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\
1⤵
PID:1728

C:\Windows\assembly\GAC_MSIL\mcstore\backup.exe
C:\Windows\assembly\GAC_MSIL\mcstore\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\
1⤵
PID:1776
- C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2656

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\
1⤵
PID:2100

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\
1⤵
PID:3004

C:\Windows\Branding\Basebrd\backup.exe
C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
1⤵
PID:620
- C:\Windows\Branding\Basebrd\en-US\backup.exe
  C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
  2⤵
  PID:1816

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\
1⤵
PID:1800

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\
1⤵
PID:1964
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\
  2⤵
  PID:2928

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:532

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\
1⤵
PID:804
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:3020
- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2972

C:\Windows\Branding\ShellBrd\backup.exe
C:\Windows\Branding\ShellBrd\backup.exe C:\Windows\Branding\ShellBrd\
1⤵
PID:2192

C:\Windows\Cursors\backup.exe
C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
1⤵
PID:1720

C:\Windows\de-DE\backup.exe
C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
1⤵
PID:2076

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\
1⤵
PID:656

C:\Windows\DigitalLocker\en-US\backup.exe
C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
1⤵
PID:320

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
1⤵
PID:548

C:\Windows\DigitalLocker\es-ES\backup.exe
C:\Windows\DigitalLocker\es-ES\backup.exe C:\Windows\DigitalLocker\es-ES\
1⤵
PID:2720

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2088

C:\Windows\DigitalLocker\ja-JP\backup.exe
C:\Windows\DigitalLocker\ja-JP\backup.exe C:\Windows\DigitalLocker\ja-JP\
1⤵
PID:1680

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\
1⤵
PID:2204

C:\Windows\ehome\backup.exe
C:\Windows\ehome\backup.exe C:\Windows\ehome\
1⤵
PID:1672
- C:\Windows\ehome\es-ES\backup.exe
  C:\Windows\ehome\es-ES\backup.exe C:\Windows\ehome\es-ES\
  2⤵
  PID:1504
- C:\Windows\ehome\fr-FR\backup.exe
  C:\Windows\ehome\fr-FR\backup.exe C:\Windows\ehome\fr-FR\
  2⤵
  PID:1640
- C:\Windows\ehome\MCX\backup.exe
  C:\Windows\ehome\MCX\backup.exe C:\Windows\ehome\MCX\
  2⤵
  PID:1004

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2536

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:2736
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\update.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\
  2⤵
  PID:1376
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\
    3⤵
    PID:2024
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\
  2⤵
  PID:1896
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\
  2⤵
  PID:2936
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\
    3⤵
    PID:832

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\
1⤵
PID:2696
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1052

C:\Windows\ehome\CreateDisc\Components\tables\update.exe
C:\Windows\ehome\CreateDisc\Components\tables\update.exe C:\Windows\ehome\CreateDisc\Components\tables\
1⤵
PID:996

C:\Windows\ehome\CreateDisc\Filters\backup.exe
C:\Windows\ehome\CreateDisc\Filters\backup.exe C:\Windows\ehome\CreateDisc\Filters\
1⤵
PID:924

C:\Windows\ehome\CreateDisc\Styles\backup.exe
C:\Windows\ehome\CreateDisc\Styles\backup.exe C:\Windows\ehome\CreateDisc\Styles\
1⤵
PID:2784
- C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe
  C:\Windows\ehome\CreateDisc\Styles\NTSC\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\
  2⤵
  PID:2896
- - C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe
    C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\
    3⤵
    PID:1996
- C:\Windows\ehome\CreateDisc\Styles\PAL\backup.exe
  C:\Windows\ehome\CreateDisc\Styles\PAL\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\
  2⤵
  PID:1300
- - C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe
    C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\backup.exe C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\
    3⤵
    PID:2708

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
1⤵
PID:2064

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\
1⤵
PID:1988
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:2428
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:2360

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\
1⤵
PID:1224

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2172

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2188

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\
1⤵
PID:2828
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\
  2⤵
  PID:980

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:2892

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\
1⤵
PID:2288

C:\Windows\ehome\wow\en-US\backup.exe
C:\Windows\ehome\wow\en-US\backup.exe C:\Windows\ehome\wow\en-US\
1⤵
PID:2116

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\
1⤵
PID:2392

C:\Windows\ehome\wow\ja-JP\backup.exe
C:\Windows\ehome\wow\ja-JP\backup.exe C:\Windows\ehome\wow\ja-JP\
1⤵
PID:2548

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2888

C:\Windows\Globalization\ELS\backup.exe
C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
1⤵
PID:1316

C:\Windows\Help\backup.exe
C:\Windows\Help\backup.exe C:\Windows\Help\
1⤵
PID:952
- C:\Windows\Help\OEM\backup.exe
  C:\Windows\Help\OEM\backup.exe C:\Windows\Help\OEM\
  2⤵
  PID:2604

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\
1⤵
PID:2640

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1768

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\
1⤵
PID:1464
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\
  2⤵
  PID:2716

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2696

C:\Windows\Help\mui\0409\backup.exe
C:\Windows\Help\mui\0409\backup.exe C:\Windows\Help\mui\0409\
1⤵
PID:2160

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\
1⤵
PID:2192

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\
1⤵
PID:2532
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:2672
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:1996
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:1932
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1936

C:\Windows\Help\mui\040C\backup.exe
C:\Windows\Help\mui\040C\backup.exe C:\Windows\Help\mui\040C\
1⤵
PID:808

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
1⤵
PID:1116

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\
1⤵
PID:576
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\
  2⤵
  PID:2828

C:\Windows\Help\Windows\de-DE\backup.exe
C:\Windows\Help\Windows\de-DE\backup.exe C:\Windows\Help\Windows\de-DE\
1⤵
PID:872

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:2144

C:\Windows\Help\Windows\en-US\backup.exe
C:\Windows\Help\Windows\en-US\backup.exe C:\Windows\Help\Windows\en-US\
1⤵
PID:376

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:2616

C:\Windows\Help\Windows\it-IT\backup.exe
C:\Windows\Help\Windows\it-IT\backup.exe C:\Windows\Help\Windows\it-IT\
1⤵
PID:2236

C:\Windows\IME\de-DE\backup.exe
C:\Windows\IME\de-DE\backup.exe C:\Windows\IME\de-DE\
1⤵
PID:880

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:2556

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\
1⤵
PID:844

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:2712

C:\Windows\IME\fr-FR\backup.exe
C:\Windows\IME\fr-FR\backup.exe C:\Windows\IME\fr-FR\
1⤵
PID:1544

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:2428
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:492

C:\Windows\IME\IMEJP10\DICTS\backup.exe
C:\Windows\IME\IMEJP10\DICTS\backup.exe C:\Windows\IME\IMEJP10\DICTS\
1⤵
PID:1116

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\
1⤵
PID:1096

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\
1⤵
PID:2088

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1932

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2936

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\
1⤵
PID:700

C:\Windows\IME\imekr8\dicts\backup.exe
C:\Windows\IME\imekr8\dicts\backup.exe C:\Windows\IME\imekr8\dicts\
1⤵
PID:1936

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2536

C:\Windows\IME\IMESC5\backup.exe
C:\Windows\IME\IMESC5\backup.exe C:\Windows\IME\IMESC5\
1⤵
PID:2564

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
1⤵
PID:3020

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\
1⤵
PID:1580

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\
1⤵
PID:1808

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2248

C:\Windows\IME\IMETC10\DICTS\backup.exe
C:\Windows\IME\IMETC10\DICTS\backup.exe C:\Windows\IME\IMETC10\DICTS\
1⤵
PID:1312

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\
1⤵
PID:2492

C:\Windows\IME\it-IT\backup.exe
C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
1⤵
PID:2320

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\System Restore.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\System Restore.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\
1⤵
PID:2064
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
  2⤵
  PID:3028

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\
1⤵
PID:2156

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\
1⤵
PID:1048
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\
  2⤵
  PID:2404
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\
  2⤵
  PID:1788

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\
1⤵
PID:1212

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1612

C:\Windows\inf\ASP.NET\0009\backup.exe
C:\Windows\inf\ASP.NET\0009\backup.exe C:\Windows\inf\ASP.NET\0009\
1⤵
PID:1464

C:\Windows\inf\ASP.NET\000C\backup.exe
C:\Windows\inf\ASP.NET\000C\backup.exe C:\Windows\inf\ASP.NET\000C\
1⤵
PID:1572

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1552

C:\Windows\inf\ASP.NET\0015\backup.exe
C:\Windows\inf\ASP.NET\0015\backup.exe C:\Windows\inf\ASP.NET\0015\
1⤵
PID:1520

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2572

C:\Windows\inf\ASP.NET\0804\backup.exe
C:\Windows\inf\ASP.NET\0804\backup.exe C:\Windows\inf\ASP.NET\0804\
1⤵
PID:2584

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2396

C:\Windows\inf\ASP.NET_4.0.30319\0001\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0001\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0001\
1⤵
PID:2116

C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0005\
1⤵
PID:2268

C:\Windows\inf\ASP.NET_4.0.30319\0007\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0007\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0007\
1⤵
PID:832

C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0008\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0008\
1⤵
PID:2276

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2224

C:\Windows\inf\ASP.NET_4.0.30319\000A\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000A\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000A\
1⤵
PID:1900

C:\Windows\inf\ASP.NET_4.0.30319\000E\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000E\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000E\
1⤵
PID:2256

C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\
1⤵
PID:2016

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1800

C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0012\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0012\
1⤵
PID:1492

C:\Windows\inf\ASP.NET_4.0.30319\0013\data.exe
C:\Windows\inf\ASP.NET_4.0.30319\0013\data.exe C:\Windows\inf\ASP.NET_4.0.30319\0013\
1⤵
PID:1212

C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0015\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0015\
1⤵
PID:1188

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2288

C:\Windows\inf\ASP.NET_4.0.30319\001F\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\001F\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\001F\
1⤵
PID:996

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\
1⤵
PID:2488

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2632

C:\Windows\inf\aspnet_state\0000\backup.exe
C:\Windows\inf\aspnet_state\0000\backup.exe C:\Windows\inf\aspnet_state\0000\
1⤵
PID:2372

C:\Windows\inf\aspnet_state\0001\update.exe
C:\Windows\inf\aspnet_state\0001\update.exe C:\Windows\inf\aspnet_state\0001\
1⤵
PID:740

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\
1⤵
PID:1496

C:\Windows\inf\aspnet_state\0007\backup.exe
C:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\
1⤵
PID:2716

C:\Windows\inf\aspnet_state\0008\data.exe
C:\Windows\inf\aspnet_state\0008\data.exe C:\Windows\inf\aspnet_state\0008\
1⤵
PID:876

C:\Windows\inf\aspnet_state\000D\data.exe
C:\Windows\inf\aspnet_state\000D\data.exe C:\Windows\inf\aspnet_state\000D\
1⤵
PID:1212

C:\Windows\inf\aspnet_state\0010\backup.exe
C:\Windows\inf\aspnet_state\0010\backup.exe C:\Windows\inf\aspnet_state\0010\
1⤵
PID:2032

C:\Windows\inf\aspnet_state\0011\backup.exe
C:\Windows\inf\aspnet_state\0011\backup.exe C:\Windows\inf\aspnet_state\0011\
1⤵
PID:2440

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2288

C:\Windows\inf\aspnet_state\0013\backup.exe
C:\Windows\inf\aspnet_state\0013\backup.exe C:\Windows\inf\aspnet_state\0013\
1⤵
PID:1272

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2548

C:\Windows\inf\aspnet_state\0015\backup.exe
C:\Windows\inf\aspnet_state\0015\backup.exe C:\Windows\inf\aspnet_state\0015\
1⤵
PID:3068

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1380

C:\Windows\inf\aspnet_state\001D\backup.exe
C:\Windows\inf\aspnet_state\001D\backup.exe C:\Windows\inf\aspnet_state\001D\
1⤵
PID:1904

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\
1⤵
PID:2972
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1312

C:\Windows\inf\aspnet_state\0404\backup.exe
C:\Windows\inf\aspnet_state\0404\backup.exe C:\Windows\inf\aspnet_state\0404\
1⤵
PID:2540

C:\Windows\inf\aspnet_state\0816\backup.exe
C:\Windows\inf\aspnet_state\0816\backup.exe C:\Windows\inf\aspnet_state\0816\
1⤵
PID:2192

C:\Windows\inf\BITS\0000\backup.exe
C:\Windows\inf\BITS\0000\backup.exe C:\Windows\inf\BITS\0000\
1⤵
PID:2688

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\
1⤵
PID:2376

C:\Windows\inf\BITS\040C\backup.exe
C:\Windows\inf\BITS\040C\backup.exe C:\Windows\inf\BITS\040C\
1⤵
PID:1520

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1844

C:\Windows\inf\BITS\0410\backup.exe
C:\Windows\inf\BITS\0410\backup.exe C:\Windows\inf\BITS\0410\
1⤵
PID:2308

C:\Windows\inf\ESENT\backup.exe
C:\Windows\inf\ESENT\backup.exe C:\Windows\inf\ESENT\
1⤵
PID:608
- C:\Windows\inf\ESENT\040C\backup.exe
  C:\Windows\inf\ESENT\040C\backup.exe C:\Windows\inf\ESENT\040C\
  2⤵
  PID:2396
- C:\Windows\inf\ESENT\0411\backup.exe
  C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
  2⤵
  PID:2996

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\
1⤵
PID:2124
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:952

C:\Windows\inf\fr-FR\backup.exe
C:\Windows\inf\fr-FR\backup.exe C:\Windows\inf\fr-FR\
1⤵
PID:1780

C:\Windows\inf\it-IT\backup.exe
C:\Windows\inf\it-IT\backup.exe C:\Windows\inf\it-IT\
1⤵
PID:2712

C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\
1⤵
PID:1004
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\
  2⤵
  PID:2940
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\
    3⤵
    PID:2908
- C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\
  2⤵
  PID:2464
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\
    3⤵
    PID:1236
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\System Restore.exe
  "C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\
  2⤵
  PID:1656
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\
  2⤵
  PID:2208
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\
  2⤵
  PID:2676
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\
    3⤵
    PID:608
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\
    3⤵
    PID:2688
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\
  2⤵
  PID:2608
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\880a680b2160130c8cf858a7d2a9067d\
    3⤵
    PID:2976
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\
    3⤵
    PID:2496
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\
  2⤵
  PID:2924
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dfb5532e4cf07b7324280988a3e1cca4\
    3⤵
    PID:1280
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\
  2⤵
  PID:2568
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\System Restore.exe
    "C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\0261a298f938ba71a7aab6f91dad326d\
    3⤵
    PID:2636
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\4795e3a744b493733f9f2696a5cd8a67\
    3⤵
    PID:2576
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\
  2⤵
  PID:2424
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\
  2⤵
  PID:2708
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\d22ec1c367b915c4028867244c6a1623\
    3⤵
    PID:3008
- C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\
  2⤵
  PID:2204
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\
    3⤵
    PID:1612
- C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\
  2⤵
  PID:2632
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\
  2⤵
  PID:1332
- C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\
  2⤵
  PID:1960
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\
  2⤵
  PID:2460
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\
  2⤵
  PID:1424
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\
  2⤵
  PID:2836
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\
  2⤵
  PID:2656
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\
  2⤵
  PID:2624
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\
  2⤵
  PID:1348
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\
  2⤵
  PID:2784
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\
  2⤵
  PID:2104
- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\
  2⤵
  PID:2480
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\eca4310274a7a6ce651b33cd4278610c\
    3⤵
    PID:684
- C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\data.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\
  2⤵
  PID:296

C:\Windows\inf\MSDTC\backup.exe
C:\Windows\inf\MSDTC\backup.exe C:\Windows\inf\MSDTC\
1⤵
PID:2716
- C:\Windows\inf\MSDTC\0407\backup.exe
  C:\Windows\inf\MSDTC\0407\backup.exe C:\Windows\inf\MSDTC\0407\
  2⤵
  PID:1844
- C:\Windows\inf\MSDTC\0C0A\backup.exe
  C:\Windows\inf\MSDTC\0C0A\backup.exe C:\Windows\inf\MSDTC\0C0A\
  2⤵
  PID:1976

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2792

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\
1⤵
PID:772

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0407\
1⤵
PID:1596

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2564

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\
1⤵
PID:1524

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:1096

C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\
1⤵
PID:2892

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\
1⤵
PID:2240

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2396

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1568

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\System Restore.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\System Restore.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000E\
1⤵
PID:1524

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\
1⤵
PID:3000
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2496

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\38e4b4d4c4cf98e359438769fae66149\
1⤵
PID:2324

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\c359669d601990310a6b30ab5992ffa8\
1⤵
PID:2436

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0013\
1⤵
PID:1140

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\
1⤵
PID:1264

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2488

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\942c10614a6f8c8a22d1f74e217a11d6\
1⤵
PID:3020

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\
1⤵
PID:2816

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\
1⤵
PID:2188

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\
1⤵
PID:1028

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\
1⤵
PID:1664

C:\Windows\inf\PERFLIB\0000\backup.exe
C:\Windows\inf\PERFLIB\0000\backup.exe C:\Windows\inf\PERFLIB\0000\
1⤵
PID:1648

C:\Windows\inf\PERFLIB\0409\backup.exe
C:\Windows\inf\PERFLIB\0409\backup.exe C:\Windows\inf\PERFLIB\0409\
1⤵
PID:2768

C:\Windows\inf\PERFLIB\0C0A\backup.exe
C:\Windows\inf\PERFLIB\0C0A\backup.exe C:\Windows\inf\PERFLIB\0C0A\
1⤵
PID:2140

C:\Windows\inf\PNRPSvc\0000\backup.exe
C:\Windows\inf\PNRPSvc\0000\backup.exe C:\Windows\inf\PNRPSvc\0000\
1⤵
PID:2468

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:2168

C:\Windows\inf\PNRPSvc\0407\backup.exe
C:\Windows\inf\PNRPSvc\0407\backup.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:3060

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1960

C:\Windows\inf\PNRPSvc\0C0A\backup.exe
C:\Windows\inf\PNRPSvc\0C0A\backup.exe C:\Windows\inf\PNRPSvc\0C0A\
1⤵
PID:2660

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\
1⤵
PID:2832
- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:740

C:\Windows\inf\rdyboost\backup.exe
C:\Windows\inf\rdyboost\backup.exe C:\Windows\inf\rdyboost\
1⤵
PID:2392
- C:\Windows\inf\rdyboost\0411\backup.exe
  C:\Windows\inf\rdyboost\0411\backup.exe C:\Windows\inf\rdyboost\0411\
  2⤵
  PID:2396

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1280

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1588

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2172

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1900

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\dc575bdefe4a3442f165f8418535d9af\
1⤵
PID:2756

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
1⤵
PID:2520

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\
1⤵
PID:2512
- C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe
  "C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\
  2⤵
  PID:2744
- C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\backup.exe
  "C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\
  2⤵
  PID:2916
- C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe
  "C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\
  2⤵
  PID:2880
- C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe
  "C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\
  2⤵
  PID:1692

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2024

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\
1⤵
PID:2180

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:1988

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2548

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\
1⤵
PID:1192

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\
1⤵
PID:2816

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2660

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2440

C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0C0A\
1⤵
PID:1640

C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\
1⤵
PID:2648

C:\Windows\inf\ServiceModelService 3.0.0.0\0000\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0000\
1⤵
PID:1044

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\3710621dc3c65616c4f62bd92619fe01\
1⤵
PID:1848

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\40e947ae0ec2fd2f63e8ca522f606aec\
1⤵
PID:1628

C:\Windows\inf\ServiceModelService 3.0.0.0\040C\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\040C\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\040C\
1⤵
PID:1592

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\
1⤵
PID:2456
- C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\
  2⤵
  PID:2076

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\
1⤵
PID:876

C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\
1⤵
PID:2696

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\e166ff6b4e2f181ace48ef30fcc1b55c\
1⤵
PID:1700

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\
1⤵
PID:2936

C:\Windows\inf\SMSvcHost 3.0.0.0\0407\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0407\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0407\
1⤵
PID:2764

C:\Windows\inf\SMSvcHost 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0C0A\
1⤵
PID:1428

C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe
"C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\
1⤵
PID:532
- C:\Windows\inf\SMSvcHost 4.0.0.0\0005\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0005\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0005\
  2⤵
  PID:1496
- C:\Windows\inf\SMSvcHost 4.0.0.0\0011\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0011\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0011\
  2⤵
  PID:1900
- C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0014\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0014\
  2⤵
  PID:740
- C:\Windows\inf\SMSvcHost 4.0.0.0\0019\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0019\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0019\
  2⤵
  PID:476
- C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0404\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0404\
  2⤵
  PID:304
- C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\0816\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0816\
  2⤵
  PID:1668

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\86550fdda6994a9c192d7a0b9b59ee5b\
1⤵
PID:2532

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\
1⤵
PID:840

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2400

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\
1⤵
PID:2316

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\System Restore.exe" C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\
1⤵
PID:2700
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\data.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1552
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\update.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:1856

C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\
1⤵
PID:2140

C:\Windows\inf\TermService\backup.exe
C:\Windows\inf\TermService\backup.exe C:\Windows\inf\TermService\
1⤵
PID:2088
- C:\Windows\inf\TermService\0000\System Restore.exe
  "C:\Windows\inf\TermService\0000\System Restore.exe" C:\Windows\inf\TermService\0000\
  2⤵
  PID:628
- C:\Windows\inf\TermService\0407\backup.exe
  C:\Windows\inf\TermService\0407\backup.exe C:\Windows\inf\TermService\0407\
  2⤵
  PID:1804

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\
1⤵
PID:1708
- C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1288

C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\
1⤵
PID:2680

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\
1⤵
PID:1668

C:\Windows\inf\UGatherer\0409\backup.exe
C:\Windows\inf\UGatherer\0409\backup.exe C:\Windows\inf\UGatherer\0409\
1⤵
PID:2064

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2132

C:\Windows\inf\UGatherer\0410\backup.exe
C:\Windows\inf\UGatherer\0410\backup.exe C:\Windows\inf\UGatherer\0410\
1⤵
PID:2432

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\
1⤵
PID:2188

C:\Windows\inf\UGTHRSVC\backup.exe
C:\Windows\inf\UGTHRSVC\backup.exe C:\Windows\inf\UGTHRSVC\
1⤵
PID:2272
- C:\Windows\inf\UGTHRSVC\040C\update.exe
  C:\Windows\inf\UGTHRSVC\040C\update.exe C:\Windows\inf\UGTHRSVC\040C\
  2⤵
  PID:3068
- C:\Windows\inf\UGTHRSVC\0410\backup.exe
  C:\Windows\inf\UGTHRSVC\0410\backup.exe C:\Windows\inf\UGTHRSVC\0410\
  2⤵
  PID:3056
- C:\Windows\inf\UGTHRSVC\0C0A\backup.exe
  C:\Windows\inf\UGTHRSVC\0C0A\backup.exe C:\Windows\inf\UGTHRSVC\0C0A\
  2⤵
  PID:1424

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:2312

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\
1⤵
PID:1040
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2032

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\
1⤵
PID:2740

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3044

C:\Windows\inf\usbhub\backup.exe
C:\Windows\inf\usbhub\backup.exe C:\Windows\inf\usbhub\
1⤵
PID:1568
- C:\Windows\inf\usbhub\0410\data.exe
  C:\Windows\inf\usbhub\0410\data.exe C:\Windows\inf\usbhub\0410\
  2⤵
  PID:1804
- C:\Windows\inf\usbhub\0411\update.exe
  C:\Windows\inf\usbhub\0411\update.exe C:\Windows\inf\usbhub\0411\
  2⤵
  PID:2588

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\
1⤵
PID:2188
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:644

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\
1⤵
PID:1192

C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\
1⤵
PID:2360
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\040C\
  2⤵
  PID:548
- C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0C0A\
  2⤵
  PID:1760

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\
1⤵
PID:604

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\
1⤵
PID:2016

C:\Windows\Logs\backup.exe
C:\Windows\Logs\backup.exe C:\Windows\Logs\
1⤵
PID:2680
- C:\Windows\Logs\DPX\backup.exe
  C:\Windows\Logs\DPX\backup.exe C:\Windows\Logs\DPX\
  2⤵
  PID:2948

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\eae18653a1b39fe484b49963d43480ce\
1⤵
PID:2476

C:\Windows\Media\Cityscape\backup.exe
C:\Windows\Media\Cityscape\backup.exe C:\Windows\Media\Cityscape\
1⤵
PID:2876

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\32088676b4c08d192aae910cac1dade4\
1⤵
PID:2784

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:892

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\
1⤵
PID:2580

C:\Windows\Media\Sonata\backup.exe
C:\Windows\Media\Sonata\backup.exe C:\Windows\Media\Sonata\
1⤵
PID:2712

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe
"C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\
1⤵
PID:2008

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2436

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\
1⤵
PID:2760
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2644

C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2404

C:\Windows\inf\wsearchidxpi\backup.exe
C:\Windows\inf\wsearchidxpi\backup.exe C:\Windows\inf\wsearchidxpi\
1⤵
PID:548

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\
1⤵
PID:1604
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3020

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:2284

C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\
1⤵
PID:2444

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\
1⤵
PID:1244

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:1936

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:2488

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:296

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\
1⤵
PID:1072

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1316

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\
1⤵
PID:2008

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1740

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\
1⤵
PID:2540

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\
1⤵
PID:2664

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\
1⤵
PID:468

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\
1⤵
PID:2160

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\
1⤵
PID:2452
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:1976

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2108

C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:3008

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\
1⤵
PID:1288

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\
1⤵
PID:2160

C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\
1⤵
PID:2468

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\
1⤵
PID:772

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1736

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\
1⤵
PID:532

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1600

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\d122f8c71cdd586e76d9617f80a0297f\
1⤵
PID:2148

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\
1⤵
PID:2400

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\
1⤵
PID:2396

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:536

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\
1⤵
PID:548

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\
1⤵
PID:1616

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:356

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:896

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\
1⤵
PID:1484

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\
1⤵
PID:1728

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\
1⤵
PID:1380

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\
1⤵
PID:2876

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\
1⤵
PID:1212

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2508

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\
1⤵
PID:2376

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\
1⤵
PID:1224
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2532

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:476

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2032

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:2236

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\
1⤵
PID:1116

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\e049a1a3948a031aed69690fc102ea6c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\e049a1a3948a031aed69690fc102ea6c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstoredb\e049a1a3948a031aed69690fc102ea6c\
1⤵
PID:1140

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1952

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1052

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\
1⤵
PID:1048

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_en_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_en_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1612

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\
1⤵
PID:1792

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\
1⤵
PID:1740

C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\
1⤵
PID:1464

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\
1⤵
PID:2288
- C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:1716

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\
1⤵
PID:2636

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\
1⤵
PID:2536

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\
1⤵
PID:448
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\
  2⤵
  PID:2824

C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\
1⤵
PID:2104

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\
1⤵
PID:2628

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\ce17670e5d6d33a85e64766e340a2176\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\ce17670e5d6d33a85e64766e340a2176\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\ce17670e5d6d33a85e64766e340a2176\
1⤵
PID:2560

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\
1⤵
PID:2984
- C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2308

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\
1⤵
PID:1980

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2376

C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:644

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\997418025a2c73d8088b0f59264a6f2b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\997418025a2c73d8088b0f59264a6f2b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\997418025a2c73d8088b0f59264a6f2b\
1⤵
PID:3064

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b023321bc53c20c10ccbbd8f78c82c82\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b023321bc53c20c10ccbbd8f78c82c82\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b023321bc53c20c10ccbbd8f78c82c82\
1⤵
PID:2528

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\ec50af274bf7a15fb59ac1f0d353b7ea\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\ec50af274bf7a15fb59ac1f0d353b7ea\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\ec50af274bf7a15fb59ac1f0d353b7ea\
1⤵
PID:2008

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\
1⤵
PID:1192

C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2240

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualC\692d1ed105277febf1550c93d00cd202\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualC\692d1ed105277febf1550c93d00cd202\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualC\692d1ed105277febf1550c93d00cd202\
1⤵
PID:804

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2220

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2236

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a178c0607d3809c8334a450b9b839b43\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a178c0607d3809c8334a450b9b839b43\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a178c0607d3809c8334a450b9b839b43\
1⤵
PID:2624

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a5daafd496ae30928b7ac626037af53c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a5daafd496ae30928b7ac626037af53c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a5daafd496ae30928b7ac626037af53c\
1⤵
PID:2520

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1996

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.TypeConverter\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.TypeConverter\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.TypeConverter\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2868

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2360

C:\Windows\assembly\NativeImages_v2.0.50727_64\napcrypt\d95f343677c556b67e99818cc02f4214\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\napcrypt\d95f343677c556b67e99818cc02f4214\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\napcrypt\d95f343677c556b67e99818cc02f4214\
1⤵
PID:2444

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1280

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
dbe4a6a29c6ddec8ea00fc837ccde06b

SHA1
9ea2428ed2ab15ec4088f8d7230be838f9a5f2f1

SHA256
194694e01a064db9563f934cdcd8bd5986bf6c936e1be9a30f75998160a1d0b4

SHA512
1c9bb9b364882558d1af62b74ea32d0c5e407580a7b44a5c8e4bfac2fa553b52f2e7166b91c2cc77fccc4cc01386870067515e7cc3b8f5f7ad23463bf97a627a

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
381626cad5b7cba3d3c1a84e2b7611e0

SHA1
6fdc7eb187e7012cab7b3f56844a6eb8e3f00bc0

SHA256
55025ab5338cbca6272a04c04bbae4b46b3cf2ee52abbb4158123343f0c82064

SHA512
9a4937199f48d4a49c1fa2ccbdb2f7422c81c41a73550a82d6e9c35f167242c1457323b699177f183bf80b9cafd2bd6f807f20e74eb95d9e4a23936e864ae772

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
3e636a01ddb2cb1e8f44616690f3e3b6

SHA1
5605a1a35944332e1cf2a3f11637310b79a3e1d8

SHA256
52720cdd1e866f2d21ae02c1f09c8f7a8bbff8839f4ca8a1cff79242ca556221

SHA512
b7e5d287cc0fff90fdb5735e7299eafe959b1691e4abedaa9d3756720bc283cd7476cc07300a418108aab78b293eff7a3a453093b8f4771cf22878ab46f3609d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\data.exe

Filesize
72KB

MD5
9a32243c26cb2797fae6feff18b34777

SHA1
b63e305636157b00d951beb994f12fbba9f941b1

SHA256
448b74ae335b937288ed3f3590e33e1f3db4a373c657a1b5a1bc731220d0b43e

SHA512
7a2390eb8f0494ed951e8728764600a885c365864df520611cb62b80ffc2d6937965a6c067dfda7257e1c7bc2dc7c3bc7d83eaa3f609870e8c74808b1b071152

Download Submit
C:\Users\Admin\AppData\Local\Temp\3903087535\backup.exe

Filesize
72KB

MD5
579bd3198c037899b7aaba6a3b381133

SHA1
ec9073e683231994c91f67857c6b30559245b9df

SHA256
02ac519508c725244303012807ed2b9ab6f7db46a86cd8cc1be670a184c1e0cb

SHA512
2c0897e313437366cae72060b6923250467aca48b4f9230ac09ba541f1880ea1e6c6c2c1399c6113b05310204a80e40e3d1da77430885102caa98f6c56d0f4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
fd3f16fd97b4bf76b3bcd8d1da817074

SHA1
5e03471756425b14de38eeef7d24c9e5787eb972

SHA256
7aa6766765b24ff6a44de075893c914dd02742c3539af245420ea3b2082455fd

SHA512
4d275a04defa358eea185f89b3c0898ff152d723756c9b37eb50327d8f9decc58a134a1529329f07d76480300d6ff2693790921aaf12dc02b0f96bf0bac2f202

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
72KB

MD5
aed5c7328f278f7f4c2238c3ac540275

SHA1
0a07d99159e2419b75bfa58144ecdd0549fb9723

SHA256
9c7553311fb785c182aef0208061f588597991e2280bd657ccf30ddc062fa72b

SHA512
708a79bcf609f4deca2ff4affb00d8ee3e06b7b4cef5db9c1ddfd07a9e2b529f4c7d1f72620c7b6c1e3a6f6fb950147f1f282c4c39ad12284ca111687fde3a91

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
72KB

MD5
b26de918f0143d6fb4f1a7e926a47385

SHA1
f409e0a1935564b686959f55aa6d61f55f50e561

SHA256
f04a92d97fba5e4742445f8b2204fcd206203ffbca0cbfc481ae7cc4f4a4e07b

SHA512
ccdf00c652c17adde76eaa4917a90ce8b5bd06d9bdec5f07a364c75f6c84ff8dca295fff860392ef88ca070395f2a56fd509e0ae85128ae8aa0d8d2d34b9d872

Download Submit
memory/1272-14665-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1288-16335-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1384-8479-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1472-15210-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1484-12846-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1504-9132-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1540-9668-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1616-5966-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/1908-16634-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1964-17333-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2040-15290-0x00000000777D0000-0x00000000778CA000-memory.dmp

Filesize
1000KB

Download
memory/2124-12631-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2304-17389-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/2824-17604-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2900-10126-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads