1540021453d7128a865f1103154e50df250fa36145ffbfdacaf053733bf6071d

Analysis

max time kernel
75s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c37af6528f83a6d18b859ba48c2dd50_NeikiAnalytics.exe
Size

72KB
MD5

8c37af6528f83a6d18b859ba48c2dd50
SHA1

1ca6daa00155f503ead8bf36eff3209097aeef9b
SHA256

1540021453d7128a865f1103154e50df250fa36145ffbfdacaf053733bf6071d
SHA512

a4aabd097142b298530d9a7e87b0c3220b9815178e2630b82d0410d0fb9210b3c4940dcf97b8f4d23798377b54f2d615a731b71a9d8ae61fa5e2f75737907f98
SSDEEP

768:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr3np:ieTce/U/hKYuKXp

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\8c37af6528f83a6d18b859ba48c2dd50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c37af6528f83a6d18b859ba48c2dd50_NeikiAnalytics.exe"
1⤵
PID:2260
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2860

C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_551961066\CRX_INSTALL\
1⤵
PID:2648

C:\Program Files\7-Zip\Lang\backup.exe
"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
1⤵
PID:1900

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:680
- C:\Program Files\Common Files\Microsoft Shared\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
  2⤵
  PID:1400
- - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
    3⤵
    PID:1388
- - C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
    3⤵
    PID:1772
  - - C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
      4⤵
      PID:904
  - - C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
      4⤵
      PID:700
  - - C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
      4⤵
      PID:940
  - - C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
      4⤵
      PID:1456
  - - C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
      4⤵
      PID:108
  - - C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
      4⤵
      PID:924
  - - C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
      4⤵
      PID:320
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
      4⤵
      PID:2824
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
      4⤵
      PID:2112
    - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
        5⤵
        
        PID:2348
    - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
        5⤵
        
        PID:2536
    - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
        5⤵
        
        PID:2696
    - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
        5⤵
        
        PID:2540
    - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
        5⤵
        
        PID:2664
  - - C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
      4⤵
      PID:1848
  - - C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
      4⤵
      PID:2408
  - - C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
      4⤵
      PID:1740
  - - C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
      4⤵
      PID:1352
  - - C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
      4⤵
      PID:2084
  - - C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
      4⤵
      PID:2272
  - - C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
      4⤵
      PID:624
  - - C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
      4⤵
      PID:1856
  - - C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
      4⤵
      PID:1892
  - - C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
      4⤵
      PID:2224
  - - C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\update.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
      4⤵
      PID:2572
  - - C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
      4⤵
      PID:2004
  - - C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
      4⤵
      PID:1696
  - - C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
      4⤵
      PID:1604
  - - C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
      4⤵
      PID:2228
  - - C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
      4⤵
      PID:412
  - - C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
      4⤵
      PID:1504
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
    3⤵
    PID:1012
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
      4⤵
      PID:848
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
      4⤵
      PID:1988
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
      4⤵
      PID:2168
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
      4⤵
      PID:2248
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
      4⤵
      PID:880
- - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
    3⤵
    PID:2820
  - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
      4⤵
      PID:1528
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
    3⤵
    PID:2556
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
      4⤵
      PID:2696
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
      4⤵
      PID:2744
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
      4⤵
      PID:2460
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
      4⤵
      PID:2060
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
    3⤵
    PID:2644
  - - C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\data.exe
      "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
      4⤵
      PID:2496
- C:\Program Files\Common Files\System\data.exe
  "C:\Program Files\Common Files\System\data.exe" C:\Program Files\Common Files\System\
  2⤵
  PID:2208
- - C:\Program Files\Common Files\System\ado\backup.exe
    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
    3⤵
    PID:2000
  - - C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe
      "C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\
      4⤵
      PID:1176
  - - C:\Program Files\Common Files\System\ado\en-US\backup.exe
      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
      4⤵
      PID:2896
- - C:\Program Files\Common Files\System\en-US\backup.exe
    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
    3⤵
    PID:1304

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:2032
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
  2⤵
  PID:1892

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
1⤵
PID:324

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:2196

C:\Program Files\Common Files\System\Ole DB\de-DE\data.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\data.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2696

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2732

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:2432

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
1⤵
PID:2216

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
1⤵
PID:1696

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
1⤵
PID:400

C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\System Restore.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
1⤵
PID:2832

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:1836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:1780
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\System Restore.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
  2⤵
  PID:1628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:2992

C:\Program Files\Internet Explorer\it-IT\backup.exe
"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
1⤵
PID:844

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
1⤵
PID:1700

C:\Program Files\Java\jdk1.7.0_80\db\update.exe
"C:\Program Files\Java\jdk1.7.0_80\db\update.exe" C:\Program Files\Java\jdk1.7.0_80\db\
1⤵
PID:2452
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:1900

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:1392
- C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
  2⤵
  PID:1716

C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
1⤵
PID:1696

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:2884

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:2004

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:568

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
1⤵
PID:3060

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
1⤵
PID:2256

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
1⤵
PID:2528
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
  2⤵
  PID:2140
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
  2⤵
  PID:2948
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
  2⤵
  PID:2484
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
  2⤵
  PID:1268
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
  2⤵
  PID:1348

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
1⤵
PID:2700

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:2172
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:1252
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
    3⤵
    PID:1900
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
    3⤵
    PID:1976
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:1124
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:108
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
    3⤵
    PID:1612
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
    3⤵
    PID:2320
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
      4⤵
      PID:2880
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
    3⤵
    PID:2648
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
  2⤵
  PID:572
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
    3⤵
    PID:3004
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
      4⤵
      PID:1136
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
    3⤵
    PID:1456
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
      4⤵
      PID:2004
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
      4⤵
      PID:848
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
    3⤵
    PID:1944

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
1⤵
PID:2188

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2152

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
1⤵
PID:1520

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2588

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:2516

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:1836

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:1564

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:2236

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
1⤵
PID:1400

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
1⤵
PID:768

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:1824
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:756

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:1520

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
1⤵
PID:1628

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:2936

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
1⤵
PID:2460
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
  2⤵
  PID:1780

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:2860

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:2736

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:1280

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
1⤵
PID:1560

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:536

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
1⤵
PID:2452

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
1⤵
PID:2356

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:1896

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
1⤵
PID:1460

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
1⤵
PID:1644

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:2444
- C:\Program Files\Java\jre7\bin\server\backup.exe
  "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
  2⤵
  PID:1444

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:2248

C:\Program Files\Java\jre7\lib\applet\backup.exe
"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:2364

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:2404
- C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
  2⤵
  PID:2112
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
    3⤵
    PID:2732

C:\Program Files\Java\jre7\lib\management\backup.exe
"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
1⤵
PID:2512

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
1⤵
PID:1572

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:1900

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
1⤵
PID:3056

C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe
"C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
1⤵
PID:2976

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
1⤵
PID:2888

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
1⤵
PID:2544

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
1⤵
PID:2892

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\update.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
1⤵
PID:2748

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:2612
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
  2⤵
  PID:1336

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
1⤵
PID:1388

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
1⤵
PID:1784

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
1⤵
PID:1996

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
1⤵
PID:2872

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2736

C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
1⤵
PID:1672

C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
1⤵
PID:2216

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:1564

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
1⤵
PID:940

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:1424
- C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
  2⤵
  PID:400
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
  2⤵
  PID:1832
- C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
  2⤵
  PID:2532
- C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
  2⤵
  PID:1872
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
    3⤵
    PID:1588
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
    3⤵
    PID:2888
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
    3⤵
    PID:1988
- C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
  2⤵
  PID:2472
- C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
  2⤵
  PID:2776
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
  2⤵
  PID:2232
- C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
  2⤵
  PID:2196

C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
"C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
1⤵
PID:112

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2032

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
1⤵
PID:528

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
1⤵
PID:2380

C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
1⤵
PID:2488

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
1⤵
PID:2532

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
1⤵
PID:568

C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
1⤵
PID:2212

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
1⤵
PID:1340

C:\Program Files\Microsoft Games\Solitaire\update.exe
"C:\Program Files\Microsoft Games\Solitaire\update.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:1824
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:1896

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
1⤵
PID:988
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
  2⤵
  PID:1616
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
  2⤵
  PID:1020

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
1⤵
PID:360

C:\Program Files\Mozilla Firefox\browser\features\backup.exe
"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
1⤵
PID:1336

C:\Program Files\Mozilla Firefox\defaults\data.exe
"C:\Program Files\Mozilla Firefox\defaults\data.exe" C:\Program Files\Mozilla Firefox\defaults\
1⤵
PID:2080

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:940

C:\Program Files\MSBuild\Microsoft\backup.exe
"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
1⤵
PID:400
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
  2⤵
  PID:1856

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
1⤵
PID:1652

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
1⤵
PID:2360

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
1⤵
PID:1012

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
1⤵
PID:2700

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
1⤵
PID:2724

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
1⤵
PID:2280

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
1⤵
PID:324

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
1⤵
PID:2572

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:412

C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
1⤵
PID:2812

C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
1⤵
PID:1572

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
1⤵
PID:1668
- C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
  2⤵
  PID:2888

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
1⤵
PID:2504

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
1⤵
PID:1832

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
1⤵
PID:2196

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
1⤵
PID:1760

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
1⤵
PID:760

C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
1⤵
PID:1508

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
1⤵
PID:2036

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
1⤵
PID:1004

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
1⤵
PID:2512

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
1⤵
PID:2000

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
1⤵
PID:2716

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
1⤵
PID:1824

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
1⤵
PID:1988

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
1⤵
PID:984
- C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
  2⤵
  PID:1612

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
1⤵
PID:2200

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
1⤵
PID:2020

C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
1⤵
PID:2856

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
1⤵
PID:2288

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\
1⤵
PID:1644
- C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\
  2⤵
  PID:2068

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
1⤵
PID:1616

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
1⤵
PID:2700

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\
1⤵
PID:1532

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:2220

C:\Program Files (x86)\Common Files\System\ado\de-DE\data.exe
"C:\Program Files (x86)\Common Files\System\ado\de-DE\data.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
1⤵
PID:2188

C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
1⤵
PID:2808

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
1⤵
PID:3060

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
1⤵
PID:1136

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
1⤵
PID:2224

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:2936

C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
1⤵
PID:2912
- C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
  2⤵
  PID:1548

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\
1⤵
PID:1724

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\
1⤵
PID:2276

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
1⤵
PID:2440

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:2364

C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
1⤵
PID:1848
- C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
  2⤵
  PID:2992

C:\Program Files (x86)\Google\Update\Download\backup.exe
"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
1⤵
PID:2632
- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
  2⤵
  PID:2728

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:1620

C:\Program Files (x86)\Internet Explorer\backup.exe
"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
1⤵
PID:2232
- C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
  "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
  2⤵
  PID:848

C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
1⤵
PID:2660

C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
1⤵
PID:332

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
1⤵
PID:2164

C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
1⤵
PID:3052
- C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
  2⤵
  PID:840

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
1⤵
PID:1016

C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
1⤵
PID:2504
- C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
  2⤵
  PID:1852

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\
1⤵
PID:880

C:\Program Files (x86)\Microsoft Office\backup.exe
"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
1⤵
PID:2700
- C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Stationery\
  2⤵
  PID:2984
- - C:\Program Files (x86)\Microsoft Office\Stationery\1033\System Restore.exe
    "C:\Program Files (x86)\Microsoft Office\Stationery\1033\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Stationery\1033\
    3⤵
    PID:1524
- C:\Program Files (x86)\Microsoft Office\Templates\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\
  2⤵
  PID:1628
- - C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\
    3⤵
    PID:848

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:2984

C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
1⤵
PID:1872

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\update.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\update.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
1⤵
PID:2948

C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
1⤵
PID:2484

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe
"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
1⤵
PID:2684

C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
1⤵
PID:2412

C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
1⤵
PID:2528

C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
1⤵
PID:1576

C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\
1⤵
PID:1964
- C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\System Restore.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\
  2⤵
  PID:2060

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:2416

C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
1⤵
PID:1516

C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
1⤵
PID:1528

C:\Program Files\VideoLAN\VLC\locale\si\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\
1⤵
PID:2556

C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
1⤵
PID:2644

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\
1⤵
PID:2464

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\
1⤵
PID:2216

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
1⤵
PID:1348

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\
1⤵
PID:3036

C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
1⤵
PID:1432

C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
1⤵
PID:412

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\
1⤵
PID:848

C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
1⤵
PID:1896

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\
1⤵
PID:1536

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\
1⤵
PID:2404

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\
1⤵
PID:352

C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\
1⤵
PID:2852
- C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\
  2⤵
  PID:2016

C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
1⤵
PID:1736
- C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
  2⤵
  PID:536

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:2828

C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\
1⤵
PID:2856

C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
1⤵
PID:2908

C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
1⤵
PID:1536
- C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
  2⤵
  PID:1724

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\
1⤵
PID:348
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\
  2⤵
  PID:792

C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
1⤵
PID:2888
- C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
  2⤵
  PID:1704

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\
1⤵
PID:860
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\
  2⤵
  PID:400

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:2392

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\
1⤵
PID:1404

C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
1⤵
PID:1848

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\
1⤵
PID:2516

C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
1⤵
PID:536

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\
1⤵
PID:2028

C:\Users\Admin\Documents\update.exe
C:\Users\Admin\Documents\update.exe C:\Users\Admin\Documents\
1⤵
PID:2244

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:2324

C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
1⤵
PID:1592

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\
1⤵
PID:2036

C:\Users\Admin\Links\backup.exe
C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
1⤵
PID:1964

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\
1⤵
PID:2692

C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
1⤵
PID:2804

C:\Users\Admin\Videos\backup.exe
C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
1⤵
PID:2320

C:\Users\Public\backup.exe
C:\Users\Public\backup.exe C:\Users\Public\
1⤵
PID:2612

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:848

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\
1⤵
PID:2068

C:\Users\Public\Recorded TV\Sample Media\data.exe
"C:\Users\Public\Recorded TV\Sample Media\data.exe" C:\Users\Public\Recorded TV\Sample Media\
1⤵
PID:2152

C:\Program Files\VideoLAN\VLC\plugins\logger\data.exe
"C:\Program Files\VideoLAN\VLC\plugins\logger\data.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
1⤵
PID:320

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\
1⤵
PID:572

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\
1⤵
PID:2120

C:\Windows\AppPatch\backup.exe
C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
1⤵
PID:2320
- C:\Windows\AppPatch\AppPatch64\backup.exe
  C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
  2⤵
  PID:1836
- C:\Windows\AppPatch\en-US\backup.exe
  C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
  2⤵
  PID:2896
- C:\Windows\AppPatch\ja-JP\backup.exe
  C:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\
  2⤵
  PID:2152

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\
1⤵
PID:2472

C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\mux\
1⤵
PID:768

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\
1⤵
PID:668

C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
1⤵
PID:1640

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\
1⤵
PID:2156

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\
1⤵
PID:2496

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\
1⤵
PID:336

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\System Restore.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\
1⤵
PID:1096
- C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\
  2⤵
  PID:1992

C:\Program Files\VideoLAN\VLC\skins\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
1⤵
PID:3048
- C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
  2⤵
  PID:2856

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\
1⤵
PID:2188

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
1⤵
PID:2204

C:\Program Files\Windows Defender\de-DE\backup.exe
"C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
1⤵
PID:2044

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\update.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\update.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\
1⤵
PID:952

C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\data.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\data.exe" C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\
1⤵
PID:2524

C:\Windows\assembly\GAC\MSDATASRC\backup.exe
C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\
1⤵
PID:2604

C:\Windows\assembly\GAC\stdole\backup.exe
C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\
1⤵
PID:572
- C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
  2⤵
  PID:1988

C:\Program Files\Windows Defender\ja-JP\backup.exe
"C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
1⤵
PID:480

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\
1⤵
PID:1760
- C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2272

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\
1⤵
PID:2160

C:\Program Files\Windows Journal\de-DE\backup.exe
"C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
1⤵
PID:2992

C:\Program Files\Windows Journal\es-ES\backup.exe
"C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
1⤵
PID:1564

C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\
1⤵
PID:1648

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
1⤵
PID:1824

C:\Program Files (x86)\Microsoft Office\Office14\PROOF\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PROOF\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\
1⤵
PID:2036
- C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\
  2⤵
  PID:2768

C:\Program Files\Windows Mail\de-DE\backup.exe
"C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
1⤵
PID:2864

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2100

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1268

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\backup.exe
"C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\
1⤵
PID:1260

C:\Program Files\Windows Mail\ja-JP\backup.exe
"C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
1⤵
PID:700

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:924

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\System Restore.exe
"C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\
1⤵
PID:1280

C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\
1⤵
PID:1556
- C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe
  "C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\
  2⤵
  PID:1448

C:\Program Files\Windows Media Player\Media Renderer\backup.exe
"C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
1⤵
PID:1528

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
1⤵
PID:1964

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\
1⤵
PID:1724

C:\Program Files\Windows Media Player\Network Sharing\backup.exe
"C:\Program Files\Windows Media Player\Network Sharing\backup.exe" C:\Program Files\Windows Media Player\Network Sharing\
1⤵
PID:2100

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\
1⤵
PID:2192
- C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2464

C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\
1⤵
PID:2340

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\
1⤵
PID:1020

C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe
"C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe" C:\Program Files\Windows NT\Accessories\fr-FR\
1⤵
PID:1300

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe
"C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\backup.exe" C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\
1⤵
PID:1196

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
1⤵
PID:2484
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
  2⤵
  PID:2580

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\
1⤵
PID:884
- C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:876

C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe
"C:\Program Files\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files\Windows NT\TableTextService\de-DE\
1⤵
PID:1256

C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
1⤵
PID:1392
- C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
  2⤵
  PID:1924

C:\Program Files\Windows NT\TableTextService\es-ES\System Restore.exe
"C:\Program Files\Windows NT\TableTextService\es-ES\System Restore.exe" C:\Program Files\Windows NT\TableTextService\es-ES\
1⤵
PID:2396

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:1724

C:\Program Files\Windows NT\TableTextService\fr-FR\System Restore.exe
"C:\Program Files\Windows NT\TableTextService\fr-FR\System Restore.exe" C:\Program Files\Windows NT\TableTextService\fr-FR\
1⤵
PID:2752

C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe
"C:\Program Files\Windows NT\TableTextService\it-IT\backup.exe" C:\Program Files\Windows NT\TableTextService\it-IT\
1⤵
PID:3020

C:\Windows\assembly\GAC_32\mscorlib\System Restore.exe
"C:\Windows\assembly\GAC_32\mscorlib\System Restore.exe" C:\Windows\assembly\GAC_32\mscorlib\
1⤵
PID:2724
- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:2424

C:\Program Files\Windows NT\TableTextService\ja-JP\backup.exe
"C:\Program Files\Windows NT\TableTextService\ja-JP\backup.exe" C:\Program Files\Windows NT\TableTextService\ja-JP\
1⤵
PID:2848

C:\Program Files\Windows Photo Viewer\data.exe
"C:\Program Files\Windows Photo Viewer\data.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:536

C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\System Restore.exe
"C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\System Restore.exe" C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\
1⤵
PID:2656

C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:2388

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\
1⤵
PID:3000

C:\Program Files\Windows Sidebar\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\de-DE\backup.exe" C:\Program Files\Windows Sidebar\de-DE\
1⤵
PID:1480

C:\Program Files\Windows Sidebar\Gadgets\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\
1⤵
PID:1700
- C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\
  2⤵
  PID:3036
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\
    3⤵
    PID:2900
- - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\
    3⤵
    PID:2604
  - - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\
      4⤵
      PID:768
  - - C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\
      4⤵
      PID:2044
- C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\
  2⤵
  PID:1852
- - C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\update.exe
    "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\update.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\
    3⤵
    PID:3036
- - C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe
    "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\
    3⤵
    PID:304
  - - C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe
      "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\
      4⤵
      PID:2692

C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\
1⤵
PID:2936
- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2228

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\
1⤵
PID:2848

C:\Windows\assembly\GAC_32\System.Data\update.exe
C:\Windows\assembly\GAC_32\System.Data\update.exe C:\Windows\assembly\GAC_32\System.Data\
1⤵
PID:2324
- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
  2⤵
  PID:1300

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\
1⤵
PID:2184

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:2876

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\
1⤵
PID:3040

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\
1⤵
PID:2588

C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\
1⤵
PID:2740

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe
"C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\
1⤵
PID:2132

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\
1⤵
PID:1696

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2340

C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
1⤵
PID:1936

C:\Program Files (x86)\MSBuild\backup.exe
"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
1⤵
PID:2536

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2040

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:952

C:\Program Files (x86)\Reference Assemblies\backup.exe
"C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
1⤵
PID:1716
- C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\
  2⤵
  PID:2416

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\
1⤵
PID:1528

C:\Windows\assembly\GAC_64\mcstoredb\backup.exe
C:\Windows\assembly\GAC_64\mcstoredb\backup.exe C:\Windows\assembly\GAC_64\mcstoredb\
1⤵
PID:2560

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:876
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
  2⤵
  PID:2412
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
  2⤵
  PID:2020
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\
  2⤵
  PID:924

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\System Restore.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\System Restore.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\
1⤵
PID:1472
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\
  2⤵
  PID:1268

C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2332

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\
1⤵
PID:904

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\
1⤵
PID:2844
- C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:2572

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\
1⤵
PID:1532

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\data.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\data.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\
1⤵
PID:2184

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1984

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
1⤵
PID:1348

C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\
1⤵
PID:2252

C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\
1⤵
PID:2036
- C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\
  2⤵
  PID:2216

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\data.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\data.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:2728

C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
"C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
1⤵
PID:2812

C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\
1⤵
PID:2484

C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2244

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\
1⤵
PID:2468

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\
1⤵
PID:2132

C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\
1⤵
PID:1696

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1004

C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2976

C:\Program Files (x86)\Windows Media Player\backup.exe
"C:\Program Files (x86)\Windows Media Player\backup.exe" C:\Program Files (x86)\Windows Media Player\
1⤵
PID:2668
- C:\Program Files (x86)\Windows Media Player\de-DE\data.exe
  "C:\Program Files (x86)\Windows Media Player\de-DE\data.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
  2⤵
  PID:2996
- C:\Program Files (x86)\Windows Media Player\en-US\backup.exe
  "C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\
  2⤵
  PID:780
- C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe
  "C:\Program Files (x86)\Windows Media Player\ja-JP\backup.exe" C:\Program Files (x86)\Windows Media Player\ja-JP\
  2⤵
  PID:2460
- C:\Program Files (x86)\Windows Media Player\Media Renderer\update.exe
  "C:\Program Files (x86)\Windows Media Player\Media Renderer\update.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
  2⤵
  PID:1460
- C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\
  2⤵
  PID:1928
- C:\Program Files (x86)\Windows Media Player\Skins\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Skins\backup.exe" C:\Program Files (x86)\Windows Media Player\Skins\
  2⤵
  PID:2556

C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\
1⤵
PID:2188

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2700

C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1600

C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2440

C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
1⤵
PID:2120

C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\
1⤵
PID:668
- C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\
  2⤵
  PID:3048

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\update.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\
1⤵
PID:1004
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
  2⤵
  PID:2424

C:\Program Files (x86)\Windows NT\Accessories\backup.exe
"C:\Program Files (x86)\Windows NT\Accessories\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\
1⤵
PID:2420
- C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe
  "C:\Program Files (x86)\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files (x86)\Windows NT\Accessories\es-ES\
  2⤵
  PID:2444

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe
C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\
1⤵
PID:888

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
1⤵
PID:2800
- C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
  2⤵
  PID:1624

C:\Program Files (x86)\Windows NT\TableTextService\System Restore.exe
"C:\Program Files (x86)\Windows NT\TableTextService\System Restore.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:1440
- C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\de-DE\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\de-DE\
  2⤵
  PID:1016

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:320

C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
1⤵
PID:2668

C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
1⤵
PID:2084

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\
1⤵
PID:1280

C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\fr-FR\
1⤵
PID:2232

C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
1⤵
PID:1520

C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\
1⤵
PID:2400

C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:896

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
1⤵
PID:1204

C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\
1⤵
PID:320

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\
1⤵
PID:2424

C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2380

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\
1⤵
PID:668
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\update.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\
  2⤵
  PID:2844
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\
    3⤵
    PID:924
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\
    3⤵
    PID:2748

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\
1⤵
PID:2748

C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1588

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\
1⤵
PID:2564

C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiExtens\backup.exe C:\Windows\assembly\GAC_MSIL\ehiExtens\
1⤵
PID:3032

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\
1⤵
PID:1680

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\
1⤵
PID:680

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\
1⤵
PID:1852

C:\Windows\assembly\GAC_MSIL\ehiProxy\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiProxy\backup.exe C:\Windows\assembly\GAC_MSIL\ehiProxy\
1⤵
PID:584

C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\
1⤵
PID:1336

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\
1⤵
PID:1616

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\
1⤵
PID:2752
- C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\
  2⤵
  PID:240

C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2552

C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUPnP\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUPnP\
1⤵
PID:2332

C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
1⤵
PID:2856

C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1892

C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe
C:\Windows\assembly\GAC_MSIL\ehiwmp\backup.exe C:\Windows\assembly\GAC_MSIL\ehiwmp\
1⤵
PID:3040

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\update.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\update.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\
1⤵
PID:2032

C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\
1⤵
PID:2200

C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1448

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\
1⤵
PID:1732

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1584

C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1768

C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe
C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\
1⤵
PID:1708

C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe
C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\
1⤵
PID:2768

C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\
1⤵
PID:1624
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\
  2⤵
  PID:2464

C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2240

C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\
1⤵
PID:2504

C:\Windows\assembly\GAC_MSIL\loadmxf\backup.exe
C:\Windows\assembly\GAC_MSIL\loadmxf\backup.exe C:\Windows\assembly\GAC_MSIL\loadmxf\
1⤵
PID:2900

C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe
C:\Windows\assembly\GAC_MSIL\mcepg\backup.exe C:\Windows\assembly\GAC_MSIL\mcepg\
1⤵
PID:2724

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\
1⤵
PID:1036

C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\
1⤵
PID:3040

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\
1⤵
PID:2948

C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1516

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\
1⤵
PID:348

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\
1⤵
PID:584

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1724

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\
1⤵
PID:2512

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:1648

C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\
1⤵
PID:2260
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\
  2⤵
  PID:2904
- C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\
  2⤵
  PID:1588

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:1340

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2444

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2656

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
1⤵
PID:324

C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\
1⤵
PID:1932

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\
1⤵
PID:2468
- C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe
  "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\
  2⤵
  PID:584

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:1204

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\
1⤵
PID:680
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\
  2⤵
  PID:2352

C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:1480

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\
1⤵
PID:1660

C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1304

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\
1⤵
PID:2344

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\
1⤵
PID:2168

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\
1⤵
PID:1020
- C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\
  2⤵
  PID:480

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2036

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:2060

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_es_b03f5f7f11d50a3a\
1⤵
PID:2192

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1716

C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\
1⤵
PID:1532

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\
1⤵
PID:1976
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\
  2⤵
  PID:2996
- - C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe
    "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\
    3⤵
    PID:1924
- C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\
  2⤵
  PID:2208

C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe
"C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\backup.exe" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\
1⤵
PID:2184

C:\Windows\Branding\Basebrd\backup.exe
C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
1⤵
PID:2228

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2208

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\
1⤵
PID:320
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1884

C:\Windows\debug\WIA\backup.exe
C:\Windows\debug\WIA\backup.exe C:\Windows\debug\WIA\
1⤵
PID:3048

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2496

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1652

C:\Windows\DigitalLocker\it-IT\backup.exe
C:\Windows\DigitalLocker\it-IT\backup.exe C:\Windows\DigitalLocker\it-IT\
1⤵
PID:1552

C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\
1⤵
PID:1600

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\
1⤵
PID:884

C:\Windows\Downloaded Program Files\backup.exe
"C:\Windows\Downloaded Program Files\backup.exe" C:\Windows\Downloaded Program Files\
1⤵
PID:2240

C:\Windows\ehome\backup.exe
C:\Windows\ehome\backup.exe C:\Windows\ehome\
1⤵
PID:2832
- C:\Windows\ehome\CreateDisc\backup.exe
  C:\Windows\ehome\CreateDisc\backup.exe C:\Windows\ehome\CreateDisc\
  2⤵
  PID:2772
- - C:\Windows\ehome\CreateDisc\Components\data.exe
    C:\Windows\ehome\CreateDisc\Components\data.exe C:\Windows\ehome\CreateDisc\Components\
    3⤵
    PID:2936
- - C:\Windows\ehome\CreateDisc\style\backup.exe
    C:\Windows\ehome\CreateDisc\style\backup.exe C:\Windows\ehome\CreateDisc\style\
    3⤵
    PID:1628
- - C:\Windows\ehome\CreateDisc\Styles\backup.exe
    C:\Windows\ehome\CreateDisc\Styles\backup.exe C:\Windows\ehome\CreateDisc\Styles\
    3⤵
    PID:3020
- C:\Windows\ehome\MCX\backup.exe
  C:\Windows\ehome\MCX\backup.exe C:\Windows\ehome\MCX\
  2⤵
  PID:1536

C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\
1⤵
PID:1392

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2552

C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\
1⤵
PID:940

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\data.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\data.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\
1⤵
PID:1020

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1408

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\
1⤵
PID:2028

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\
1⤵
PID:2724
- C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\
  2⤵
  PID:1256

C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\
1⤵
PID:2972

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\
1⤵
PID:2808
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
  2⤵
  PID:2712

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\
1⤵
PID:584

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\
1⤵
PID:2416

C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\
1⤵
PID:1300

C:\Windows\ehome\wow\en-US\backup.exe
C:\Windows\ehome\wow\en-US\backup.exe C:\Windows\ehome\wow\en-US\
1⤵
PID:1852

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:1016

C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1600

C:\Windows\en-US\backup.exe
C:\Windows\en-US\backup.exe C:\Windows\en-US\
1⤵
PID:2976

C:\Windows\Fonts\backup.exe
C:\Windows\Fonts\backup.exe C:\Windows\Fonts\
1⤵
PID:2024

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2500

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2856

C:\Windows\Help\Corporate\backup.exe
C:\Windows\Help\Corporate\backup.exe C:\Windows\Help\Corporate\
1⤵
PID:2876

C:\Windows\Help\Help\en-US\backup.exe
C:\Windows\Help\Help\en-US\backup.exe C:\Windows\Help\Help\en-US\
1⤵
PID:2536

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\
1⤵
PID:2304

C:\Windows\Help\Help\fr-FR\backup.exe
C:\Windows\Help\Help\fr-FR\backup.exe C:\Windows\Help\Help\fr-FR\
1⤵
PID:2728

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\update.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\
1⤵
PID:1520

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1612

C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\
1⤵
PID:2312

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\
1⤵
PID:1724

C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\
1⤵
PID:680
- C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe
  "C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\
  2⤵
  PID:320

C:\Windows\Help\mui\0407\backup.exe
C:\Windows\Help\mui\0407\backup.exe C:\Windows\Help\mui\0407\
1⤵
PID:2568

C:\Windows\Help\mui\040C\backup.exe
C:\Windows\Help\mui\040C\backup.exe C:\Windows\Help\mui\040C\
1⤵
PID:1532

C:\Windows\Help\OEM\backup.exe
C:\Windows\Help\OEM\backup.exe C:\Windows\Help\OEM\
1⤵
PID:2672

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2632

C:\Windows\Help\Windows\de-DE\update.exe
C:\Windows\Help\Windows\de-DE\update.exe C:\Windows\Help\Windows\de-DE\
1⤵
PID:2540

C:\Windows\Help\Windows\it-IT\backup.exe
C:\Windows\Help\Windows\it-IT\backup.exe C:\Windows\Help\Windows\it-IT\
1⤵
PID:1392

C:\Windows\Help\Windows\ja-JP\backup.exe
C:\Windows\Help\Windows\ja-JP\backup.exe C:\Windows\Help\Windows\ja-JP\
1⤵
PID:2312

C:\Windows\IME\de-DE\backup.exe
C:\Windows\IME\de-DE\backup.exe C:\Windows\IME\de-DE\
1⤵
PID:2064

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\
1⤵
PID:2668

C:\Windows\IME\es-ES\data.exe
C:\Windows\IME\es-ES\data.exe C:\Windows\IME\es-ES\
1⤵
PID:700

C:\Windows\IME\fr-FR\backup.exe
C:\Windows\IME\fr-FR\backup.exe C:\Windows\IME\fr-FR\
1⤵
PID:1388

C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\backup.exe" C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\
1⤵
PID:2200

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\
1⤵
PID:336

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\
1⤵
PID:2252

C:\Windows\IME\IMETC10\backup.exe
C:\Windows\IME\IMETC10\backup.exe C:\Windows\IME\IMETC10\
1⤵
PID:3016

C:\Windows\inf\System Restore.exe
"C:\Windows\inf\System Restore.exe" C:\Windows\inf\
1⤵
PID:1720
- C:\Windows\inf\BITS\backup.exe
  C:\Windows\inf\BITS\backup.exe C:\Windows\inf\BITS\
  2⤵
  PID:1976
- - C:\Windows\inf\BITS\0410\System Restore.exe
    "C:\Windows\inf\BITS\0410\System Restore.exe" C:\Windows\inf\BITS\0410\
    3⤵
    PID:2064
- - C:\Windows\inf\BITS\0C0A\backup.exe
    C:\Windows\inf\BITS\0C0A\backup.exe C:\Windows\inf\BITS\0C0A\
    3⤵
    PID:1124
- C:\Windows\inf\de-DE\backup.exe
  C:\Windows\inf\de-DE\backup.exe C:\Windows\inf\de-DE\
  2⤵
  PID:2588
- C:\Windows\inf\ESENT\backup.exe
  C:\Windows\inf\ESENT\backup.exe C:\Windows\inf\ESENT\
  2⤵
  PID:2996
- - C:\Windows\inf\ESENT\0407\backup.exe
    C:\Windows\inf\ESENT\0407\backup.exe C:\Windows\inf\ESENT\0407\
    3⤵
    PID:1880
- - C:\Windows\inf\ESENT\040C\backup.exe
    C:\Windows\inf\ESENT\040C\backup.exe C:\Windows\inf\ESENT\040C\
    3⤵
    PID:1964
- - C:\Windows\inf\ESENT\0411\backup.exe
    C:\Windows\inf\ESENT\0411\backup.exe C:\Windows\inf\ESENT\0411\
    3⤵
    PID:2884
- C:\Windows\inf\es-ES\update.exe
  C:\Windows\inf\es-ES\update.exe C:\Windows\inf\es-ES\
  2⤵
  PID:240
- C:\Windows\inf\MSDTC Bridge 3.0.0.0\backup.exe
  "C:\Windows\inf\MSDTC Bridge 3.0.0.0\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\
  2⤵
  PID:2244
- - C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe
    "C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\backup.exe" C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\
    3⤵
    PID:2740
- C:\Windows\inf\RemoteAccess\data.exe
  C:\Windows\inf\RemoteAccess\data.exe C:\Windows\inf\RemoteAccess\
  2⤵
  PID:1248
- - C:\Windows\inf\RemoteAccess\0000\backup.exe
    C:\Windows\inf\RemoteAccess\0000\backup.exe C:\Windows\inf\RemoteAccess\0000\
    3⤵
    PID:1564
- - C:\Windows\inf\RemoteAccess\0410\backup.exe
    C:\Windows\inf\RemoteAccess\0410\backup.exe C:\Windows\inf\RemoteAccess\0410\
    3⤵
    PID:2252
- C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe
  "C:\Windows\inf\ServiceModelOperation 3.0.0.0\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\
  2⤵
  PID:2400
- - C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe
    "C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\backup.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\
    3⤵
    PID:2452
- - C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\data.exe
    "C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\data.exe" C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\
    3⤵
    PID:768
- C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe
  "C:\Windows\inf\SMSvcHost 4.0.0.0\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\
  2⤵
  PID:2160
- - C:\Windows\inf\SMSvcHost 4.0.0.0\000C\backup.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\000C\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\000C\
    3⤵
    PID:2900
- - C:\Windows\inf\SMSvcHost 4.0.0.0\0013\data.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\0013\data.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0013\
    3⤵
    PID:1984
- - C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\0015\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0015\
    3⤵
    PID:904
- - C:\Windows\inf\SMSvcHost 4.0.0.0\001F\backup.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\001F\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\001F\
    3⤵
    PID:2772
- - C:\Windows\inf\SMSvcHost 4.0.0.0\0404\System Restore.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\0404\System Restore.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0404\
    3⤵
    PID:2704
- - C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe
    "C:\Windows\inf\SMSvcHost 4.0.0.0\0804\backup.exe" C:\Windows\inf\SMSvcHost 4.0.0.0\0804\
    3⤵
    PID:2908
- C:\Windows\inf\TAPISRV\backup.exe
  C:\Windows\inf\TAPISRV\backup.exe C:\Windows\inf\TAPISRV\
  2⤵
  PID:2808
- C:\Windows\inf\usbhub\backup.exe
  C:\Windows\inf\usbhub\backup.exe C:\Windows\inf\usbhub\
  2⤵
  PID:1336
- - C:\Windows\inf\usbhub\0000\backup.exe
    C:\Windows\inf\usbhub\0000\backup.exe C:\Windows\inf\usbhub\0000\
    3⤵
    PID:2212
- - C:\Windows\inf\usbhub\040C\backup.exe
    C:\Windows\inf\usbhub\040C\backup.exe C:\Windows\inf\usbhub\040C\
    3⤵
    PID:1392
- - C:\Windows\inf\usbhub\0C0A\backup.exe
    C:\Windows\inf\usbhub\0C0A\backup.exe C:\Windows\inf\usbhub\0C0A\
    3⤵
    PID:400
- C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe
  "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\
  2⤵
  PID:2912
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0001\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0001\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0001\
    3⤵
    PID:1768
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0009\
    3⤵
    PID:3020
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000A\
    3⤵
    PID:1016
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0011\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0011\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0011\
    3⤵
    PID:2220
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0014\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0014\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0014\
    3⤵
    PID:1660
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001D\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001D\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\001D\
    3⤵
    PID:2736
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0416\
    3⤵
    PID:1760
- - C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0804\backup.exe
    "C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0804\backup.exe" C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0804\
    3⤵
    PID:2820
- C:\Windows\inf\wsearchidxpi\backup.exe
  C:\Windows\inf\wsearchidxpi\backup.exe C:\Windows\inf\wsearchidxpi\
  2⤵
  PID:1588
- - C:\Windows\inf\wsearchidxpi\0407\backup.exe
    C:\Windows\inf\wsearchidxpi\0407\backup.exe C:\Windows\inf\wsearchidxpi\0407\
    3⤵
    PID:2228

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\
1⤵
PID:1280

C:\Windows\inf\ASP.NET\0000\backup.exe
C:\Windows\inf\ASP.NET\0000\backup.exe C:\Windows\inf\ASP.NET\0000\
1⤵
PID:1532

C:\Windows\inf\ASP.NET\0006\backup.exe
C:\Windows\inf\ASP.NET\0006\backup.exe C:\Windows\inf\ASP.NET\0006\
1⤵
PID:2140

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2856

C:\Windows\inf\ASP.NET\0008\backup.exe
C:\Windows\inf\ASP.NET\0008\backup.exe C:\Windows\inf\ASP.NET\0008\
1⤵
PID:1588

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1924

C:\Windows\inf\ASP.NET\0009\update.exe
C:\Windows\inf\ASP.NET\0009\update.exe C:\Windows\inf\ASP.NET\0009\
1⤵
PID:2356

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\
1⤵
PID:780

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\
1⤵
PID:632

C:\Windows\inf\ASP.NET\000D\backup.exe
C:\Windows\inf\ASP.NET\000D\backup.exe C:\Windows\inf\ASP.NET\000D\
1⤵
PID:412

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.SemiTrust\
1⤵
PID:1976

C:\Windows\inf\ASP.NET\0012\backup.exe
C:\Windows\inf\ASP.NET\0012\backup.exe C:\Windows\inf\ASP.NET\0012\
1⤵
PID:2736

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath.Xml\
1⤵
PID:332

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\
1⤵
PID:1280

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\
1⤵
PID:2856
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2112

C:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0000\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0000\
1⤵
PID:1140

C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0005\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0005\
1⤵
PID:1016

C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0009\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0009\
1⤵
PID:884

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\
1⤵
PID:1352

C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\000D\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\000D\
1⤵
PID:2912

C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0010\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0010\
1⤵
PID:1136

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2192

C:\Windows\inf\ASP.NET_4.0.30319\0012\data.exe
C:\Windows\inf\ASP.NET_4.0.30319\0012\data.exe C:\Windows\inf\ASP.NET_4.0.30319\0012\
1⤵
PID:2064

C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0014\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0014\
1⤵
PID:2220

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\
1⤵
PID:1388
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:888
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2424
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1596
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2344

C:\Windows\inf\ASP.NET_4.0.30319\001F\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\001F\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\001F\
1⤵
PID:2068

C:\Windows\inf\ASP.NET_4.0.30319\0416\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0416\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0416\
1⤵
PID:1940

C:\Windows\inf\ASP.NET_4.0.30319\0804\backup.exe
C:\Windows\inf\ASP.NET_4.0.30319\0804\backup.exe C:\Windows\inf\ASP.NET_4.0.30319\0804\
1⤵
PID:1964

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\
1⤵
PID:992
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:884
- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2736

C:\Windows\inf\aspnet_state\0000\backup.exe
C:\Windows\inf\aspnet_state\0000\backup.exe C:\Windows\inf\aspnet_state\0000\
1⤵
PID:2716

C:\Windows\inf\aspnet_state\0005\backup.exe
C:\Windows\inf\aspnet_state\0005\backup.exe C:\Windows\inf\aspnet_state\0005\
1⤵
PID:860

C:\Windows\inf\aspnet_state\0007\backup.exe
C:\Windows\inf\aspnet_state\0007\backup.exe C:\Windows\inf\aspnet_state\0007\
1⤵
PID:480

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2524

C:\Windows\inf\aspnet_state\000D\backup.exe
C:\Windows\inf\aspnet_state\000D\backup.exe C:\Windows\inf\aspnet_state\000D\
1⤵
PID:2804

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:560

C:\Windows\inf\aspnet_state\0010\backup.exe
C:\Windows\inf\aspnet_state\0010\backup.exe C:\Windows\inf\aspnet_state\0010\
1⤵
PID:756

C:\Windows\inf\aspnet_state\0011\System Restore.exe
"C:\Windows\inf\aspnet_state\0011\System Restore.exe" C:\Windows\inf\aspnet_state\0011\
1⤵
PID:1832

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2456

C:\Windows\inf\aspnet_state\0012\backup.exe
C:\Windows\inf\aspnet_state\0012\backup.exe C:\Windows\inf\aspnet_state\0012\
1⤵
PID:2360

C:\Windows\inf\aspnet_state\001D\backup.exe
C:\Windows\inf\aspnet_state\001D\backup.exe C:\Windows\inf\aspnet_state\001D\
1⤵
PID:668

C:\Windows\inf\aspnet_state\0804\backup.exe
C:\Windows\inf\aspnet_state\0804\backup.exe C:\Windows\inf\aspnet_state\0804\
1⤵
PID:2640

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\
1⤵
PID:896

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2900

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:360

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2040

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:1928

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1736

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:480

C:\Windows\inf\MSDTC\040C\data.exe
C:\Windows\inf\MSDTC\040C\data.exe C:\Windows\inf\MSDTC\040C\
1⤵
PID:2496

C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\
1⤵
PID:2040
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\
  2⤵
  PID:2464

C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1300

C:\Windows\inf\MSDTC\0C0A\backup.exe
C:\Windows\inf\MSDTC\0C0A\backup.exe C:\Windows\inf\MSDTC\0C0A\
1⤵
PID:2664

C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\AuditPolicyGPManage#\
1⤵
PID:2232

C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\2823d3be9334fea94dce8001b247589b\
1⤵
PID:1016

C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\
1⤵
PID:808
- C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\
  2⤵
  PID:1556

C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\
1⤵
PID:1352

C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\
1⤵
PID:1760

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2776

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\
1⤵
PID:2880

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\7b6de29c99674df526ccf9d4937828fe\
1⤵
PID:1976

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\
1⤵
PID:2020

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\
1⤵
PID:2344

C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\
1⤵
PID:2280

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiUserXp\f09ce1eab0d18a4bbd53ab2a67a5c909\
1⤵
PID:2172

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2768

C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\
1⤵
PID:2540

C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\
1⤵
PID:1472

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_en_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_en_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_en_31bf3856ad364e35\
1⤵
PID:2508

C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\
1⤵
PID:2464

C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\
1⤵
PID:2388

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe
"C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\backup.exe" C:\Windows\inf\MSDTC Bridge 4.0.0.0\0816\
1⤵
PID:2448

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\
1⤵
PID:2420

C:\Windows\inf\PERFLIB\0000\backup.exe
C:\Windows\inf\PERFLIB\0000\backup.exe C:\Windows\inf\PERFLIB\0000\
1⤵
PID:2452

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\
1⤵
PID:2900

C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:2324

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4c0fa9d495ac562afcb136f3e9a87cb9\
1⤵
PID:2636

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\84b83e7639310b35b5ce150df62a2843\
1⤵
PID:1012

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\
1⤵
PID:2624

C:\Windows\inf\PNRPSvc\0000\backup.exe
C:\Windows\inf\PNRPSvc\0000\backup.exe C:\Windows\inf\PNRPSvc\0000\
1⤵
PID:1848

C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\
1⤵
PID:1652

C:\Windows\inf\PNRPSvc\0407\update.exe
C:\Windows\inf\PNRPSvc\0407\update.exe C:\Windows\inf\PNRPSvc\0407\
1⤵
PID:1564

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\
1⤵
PID:2356

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\d7245402b9853a8e390552ba45b3a6b4\
1⤵
PID:2936

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_de_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1648

C:\Windows\inf\PNRPSvc\0C0A\System Restore.exe
"C:\Windows\inf\PNRPSvc\0C0A\System Restore.exe" C:\Windows\inf\PNRPSvc\0C0A\
1⤵
PID:2528

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\
1⤵
PID:1668
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\
  2⤵
  PID:2220

C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_ja_31bf3856ad364e35\
1⤵
PID:1992

C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1840

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\b0d0daea6a1d9a111a0f33a9a868bcf7\
1⤵
PID:2564

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b3fde69f9642ab464bd3389f1fe3c5bd\
1⤵
PID:1852

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:2692

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\
1⤵
PID:2228

C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:1520

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\
1⤵
PID:1912

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\
1⤵
PID:1056

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1832

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\
1⤵
PID:2784

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\
1⤵
PID:1576
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\08d77067bceade0839fda4c78a304038\
  2⤵
  PID:1976
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\
  2⤵
  PID:1588
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\System Restore.exe
  "C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\
  2⤵
  PID:1572

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\
1⤵
PID:400

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0411\
1⤵
PID:1400

C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\
1⤵
PID:1564

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2008

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\
1⤵
PID:112

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\
1⤵
PID:2632

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\6cc1334749f85cce651642f0a8260892\
1⤵
PID:2832

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1256

C:\Windows\inf\ServiceModelService 3.0.0.0\0410\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0410\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0410\
1⤵
PID:1500

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\
1⤵
PID:1460

C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_ja_b03f5f7f11d50a3a\
1⤵
PID:1016

C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe
"C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\backup.exe" C:\Windows\inf\ServiceModelService 3.0.0.0\0C0A\
1⤵
PID:336

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4a235e617ad0a4c3aecd3982f0e3c48a\
1⤵
PID:1896

C:\Windows\inf\SMSvcHost 3.0.0.0\0409\System Restore.exe
"C:\Windows\inf\SMSvcHost 3.0.0.0\0409\System Restore.exe" C:\Windows\inf\SMSvcHost 3.0.0.0\0409\
1⤵
PID:1732

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\
1⤵
PID:2324

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\a415a146afc72f13f691f69a11ab5609\
1⤵
PID:2168

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1976

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\
1⤵
PID:2724
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2684

C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\
1⤵
PID:1256
- C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\
  2⤵
  PID:3032

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2164

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\
1⤵
PID:2232

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\
1⤵
PID:1696
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:1684

C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\18e41c018ceff36c2512d12f570f0be7\
1⤵
PID:2216

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\
1⤵
PID:2532

C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\
1⤵
PID:860

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\update.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2592

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2832

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\
1⤵
PID:1856

C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napcrypt\09b65f9c3f78e6ef3e259af945e937b9\
1⤵
PID:952

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2804

C:\Windows\inf\TermService\0000\backup.exe
C:\Windows\inf\TermService\0000\backup.exe C:\Windows\inf\TermService\0000\
1⤵
PID:1508

C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\
1⤵
PID:1140
- C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\napinit\6a657f2f518f97b282702fce20033459\
  2⤵
  PID:1256

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\
1⤵
PID:1932

C:\Windows\inf\TermService\040C\backup.exe
C:\Windows\inf\TermService\040C\backup.exe C:\Windows\inf\TermService\040C\
1⤵
PID:2436

C:\Windows\inf\TermService\0410\System Restore.exe
"C:\Windows\inf\TermService\0410\System Restore.exe" C:\Windows\inf\TermService\0410\
1⤵
PID:536

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:808

C:\Windows\inf\TermService\0411\backup.exe
C:\Windows\inf\TermService\0411\backup.exe C:\Windows\inf\TermService\0411\
1⤵
PID:1452

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\
1⤵
PID:1336

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2548

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\
1⤵
PID:2416
- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2912

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\
1⤵
PID:2508

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\
1⤵
PID:2808
- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\
  2⤵
  PID:2220

C:\Windows\inf\UGatherer\0411\backup.exe
C:\Windows\inf\UGatherer\0411\backup.exe C:\Windows\inf\UGatherer\0411\
1⤵
PID:1928

C:\Windows\inf\UGTHRSVC\0407\backup.exe
C:\Windows\inf\UGTHRSVC\0407\backup.exe C:\Windows\inf\UGTHRSVC\0407\
1⤵
PID:1012

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2544

C:\Windows\inf\UGTHRSVC\0410\backup.exe
C:\Windows\inf\UGTHRSVC\0410\backup.exe C:\Windows\inf\UGTHRSVC\0410\
1⤵
PID:668

C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\
1⤵
PID:1384

C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\
1⤵
PID:1352

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:320

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\
1⤵
PID:2460

C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\
1⤵
PID:1988

C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\
1⤵
PID:2904

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\
1⤵
PID:840

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\
1⤵
PID:3060

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2240

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\
1⤵
PID:1660

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\
1⤵
PID:1964

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\
1⤵
PID:2652

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\
1⤵
PID:1348

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\
1⤵
PID:844

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:1604

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\
1⤵
PID:2212

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\
1⤵
PID:872

C:\Windows\it-IT\backup.exe
C:\Windows\it-IT\backup.exe C:\Windows\it-IT\
1⤵
PID:2464

C:\Windows\ja-JP\backup.exe
C:\Windows\ja-JP\backup.exe C:\Windows\ja-JP\
1⤵
PID:2656

C:\Windows\L2Schemas\backup.exe
C:\Windows\L2Schemas\backup.exe C:\Windows\L2Schemas\
1⤵
PID:1984

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:1336

C:\Windows\Logs\backup.exe
C:\Windows\Logs\backup.exe C:\Windows\Logs\
1⤵
PID:2100
- C:\Windows\Logs\DISM\backup.exe
  C:\Windows\Logs\DISM\backup.exe C:\Windows\Logs\DISM\
  2⤵
  PID:2768
- C:\Windows\Logs\HomeGroup\System Restore.exe
  "C:\Windows\Logs\HomeGroup\System Restore.exe" C:\Windows\Logs\HomeGroup\
  2⤵
  PID:792

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\
1⤵
PID:2984

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1900

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\
1⤵
PID:2248

C:\Windows\Media\Afternoon\backup.exe
C:\Windows\Media\Afternoon\backup.exe C:\Windows\Media\Afternoon\
1⤵
PID:836

C:\Windows\Media\Characters\backup.exe
C:\Windows\Media\Characters\backup.exe C:\Windows\Media\Characters\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\
1⤵
PID:1724

C:\Windows\Media\Garden\backup.exe
C:\Windows\Media\Garden\backup.exe C:\Windows\Media\Garden\
1⤵
PID:1604

C:\Windows\Media\Heritage\data.exe
C:\Windows\Media\Heritage\data.exe C:\Windows\Media\Heritage\
1⤵
PID:1736

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\
1⤵
PID:2744

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\
1⤵
PID:2660

C:\Windows\Media\Quirky\backup.exe
C:\Windows\Media\Quirky\backup.exe C:\Windows\Media\Quirky\
1⤵
PID:1896

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2872

C:\Windows\Media\Sonata\backup.exe
C:\Windows\Media\Sonata\backup.exe C:\Windows\Media\Sonata\
1⤵
PID:1624

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_es_31bf3856ad364e35\
1⤵
PID:2988

C:\Windows\Microsoft.NET\assembly\backup.exe
C:\Windows\Microsoft.NET\assembly\backup.exe C:\Windows\Microsoft.NET\assembly\
1⤵
PID:1480

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\
1⤵
PID:1700

C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\
1⤵
PID:2720

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\
1⤵
PID:1740
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:2832
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2972
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:3016
- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2200

C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2640

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\
1⤵
PID:2228

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\
1⤵
PID:2416

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\
1⤵
PID:304
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\update.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\17e443d6c643b83137beb310adee3c48\
  2⤵
  PID:2456

C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\
1⤵
PID:2784

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\
1⤵
PID:1836

C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\
1⤵
PID:1988

C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_de_31bf3856ad364e35\
1⤵
PID:1852

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\964a515210f3bad01949e9ae4f83c7b2\
1⤵
PID:536

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:1500

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\
1⤵
PID:2004

C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\
1⤵
PID:2120
- C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\
  2⤵
  PID:1184

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\
1⤵
PID:2520
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\
  2⤵
  PID:984

C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_it_31bf3856ad364e35\
1⤵
PID:2716

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\
1⤵
PID:1900

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\System Restore.exe
"C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\
1⤵
PID:2224
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\
  2⤵
  PID:412

C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2100

C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\
1⤵
PID:352
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:2164
- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1516

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e2642bff810609f64343e53dddb6b59c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e2642bff810609f64343e53dddb6b59c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e2642bff810609f64343e53dddb6b59c\
1⤵
PID:1880

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\
1⤵
PID:1204

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\
1⤵
PID:2216

C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:788

C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\
1⤵
PID:2600

C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\
1⤵
PID:2508

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\
1⤵
PID:2828

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\
1⤵
PID:924
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\
  2⤵
  PID:2140

C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\
1⤵
PID:2548

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2636

C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:1896

C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:2028

C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\
1⤵
PID:2364

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\
1⤵
PID:940

C:\Windows\assembly\GAC_MSIL\MMCEx\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx\
1⤵
PID:2060
- C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:2032

C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\
1⤵
PID:2700
- C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2652

C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\
1⤵
PID:2804

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\
1⤵
PID:2704
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\a63e76cc86c8958f0f3e9741c0d89f14\
  2⤵
  PID:2964

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:2600

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0b5071ee1d40266575a7ac53b9b299d4\
1⤵
PID:780

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\
1⤵
PID:1616

C:\Windows\assembly\NativeImages_v2.0.50727_64\CustomMarshalers\e41fccd68a6543f2528f6f6118f5f7e2\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\CustomMarshalers\e41fccd68a6543f2528f6f6118f5f7e2\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\CustomMarshalers\e41fccd68a6543f2528f6f6118f5f7e2\
1⤵
PID:2564

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\
1⤵
PID:356
- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\c72ccbd1fef598dd897fdf0d2e49195b\
  2⤵
  PID:2304

C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\
1⤵
PID:2172
- C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\
  2⤵
  PID:2016

C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:2316

C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:400

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\
1⤵
PID:2404

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\
1⤵
PID:2768

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\
1⤵
PID:568

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\
1⤵
PID:768

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\
1⤵
PID:1900

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\02d5be8209f0eac6f7725f8d83b87df6\
1⤵
PID:1420

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\56a7faf970109dc1dc6b76f643d93c5f\
1⤵
PID:2948

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\data.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\data.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\
1⤵
PID:624

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\data.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\data.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\
1⤵
PID:2112

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\
1⤵
PID:2312

C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\
1⤵
PID:536

C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\
1⤵
PID:2752

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\
1⤵
PID:2176

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiTVMSMusic\
1⤵
PID:2828

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\
1⤵
PID:2964

C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\70aac9dff3bdde548962557151c1ff49\
1⤵
PID:1836

C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\
1⤵
PID:1700

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\
1⤵
PID:700
- C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\
  2⤵
  PID:1248

C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\99797e9500ed7bfa6b06063e7f017313\
1⤵
PID:1544

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2632

C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\
1⤵
PID:528
- C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\
  2⤵
  PID:1856

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\005810b5e7d8802575d07878997d434d\
1⤵
PID:2228

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2936

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\
1⤵
PID:924
- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\56780b4bd164787631d4317d0556c3c0\
  2⤵
  PID:2848

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\b253aa4b8000e29b2fb725e4f7b8bc7c\
1⤵
PID:1252

C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2124

C:\Windows\assembly\GAC_MSIL\napsnap.resources\backup.exe
C:\Windows\assembly\GAC_MSIL\napsnap.resources\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\
1⤵
PID:1196
- C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:1912

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\
1⤵
PID:584

C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ab8ac659d9525c6a0cd22c6f3734862f\
1⤵
PID:3048

C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\
1⤵
PID:1696

C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\
1⤵
PID:1680
- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\
  2⤵
  PID:2904

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\
1⤵
PID:1228

C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\
1⤵
PID:768
- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\30b1d86571495ea86b9a19b13498aad3\
  2⤵
  PID:2820

C:\Windows\assembly\GAC_MSIL\Narrator\backup.exe
C:\Windows\assembly\GAC_MSIL\Narrator\backup.exe C:\Windows\assembly\GAC_MSIL\Narrator\
1⤵
PID:2224
- C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\
  2⤵
  PID:1732

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\
1⤵
PID:1668

C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\System Restore.exe
"C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\System Restore.exe" C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\
1⤵
PID:2964

C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\
1⤵
PID:2392

C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\f04b0488328a68d57953149b31a85065\
1⤵
PID:624

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1416

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1988

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\
1⤵
PID:2616

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\
1⤵
PID:2332

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2364

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcplayerinterop\f7a93626b76fe66f217c19426cc5b02a\
1⤵
PID:320

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2968

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\
1⤵
PID:1200

C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\
1⤵
PID:2068
- C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\
  2⤵
  PID:876

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2828

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2280

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\01c92af8d09572a4e4ccb46e3cd71d3a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\01c92af8d09572a4e4ccb46e3cd71d3a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\01c92af8d09572a4e4ccb46e3cd71d3a\
1⤵
PID:1564

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\
1⤵
PID:1528

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\74c8f5e75ec10458436bb476c2cfd9fc\
1⤵
PID:2080

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:2692

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\
1⤵
PID:2024

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\
1⤵
PID:2204

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\
1⤵
PID:1636

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\
1⤵
PID:2032
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\2e1dbe90bc10ba70f147a249adfc7f64\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\2e1dbe90bc10ba70f147a249adfc7f64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\2e1dbe90bc10ba70f147a249adfc7f64\
  2⤵
  PID:2036
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\8c4abd55a6b822e3efbbc649c5c01a3e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\8c4abd55a6b822e3efbbc649c5c01a3e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\8c4abd55a6b822e3efbbc649c5c01a3e\
  2⤵
  PID:360

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2592

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:844

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\
1⤵
PID:1760

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\
1⤵
PID:2808
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Fra#\a71fda14114136e528b310f41dce7915\
  2⤵
  PID:2572

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2656

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2424

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\
1⤵
PID:2280

C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2188

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\
1⤵
PID:2172

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\da42912f997fae780054f0c3a6b47fea\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\da42912f997fae780054f0c3a6b47fea\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.GroupPoli#\da42912f997fae780054f0c3a6b47fea\
1⤵
PID:2404

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\System Restore.exe
"C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\System Restore.exe" C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\
1⤵
PID:3000

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\
1⤵
PID:2640

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\
1⤵
PID:772

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.JScript\71e40c479d779f2bf55bb925834e3cd3\
1⤵
PID:2064

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\
1⤵
PID:1624
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\
  2⤵
  PID:1976

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\
1⤵
PID:896

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\
1⤵
PID:1668

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\
1⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\backup.exe

Filesize
72KB

MD5
d7678033a823485e6fa589abc687f91f

SHA1
d9fce23db4cef71d08553d179c0813e98c329292

SHA256
77ece022db85a27fab8de6776bac3993d714c383c08933869e37a5bc1d30fffb

SHA512
b5e8960bc9e32ac2b1c2b2343a0b0ed073bfa08e6d250a1c19ed9ab6f181fed8efea1038b120128677de88a3a0f12281975f9c2a50c6ffb1a1ad6783dce6b0c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3994158990\backup.exe

Filesize
72KB

MD5
fc935a6373b31da391b79644dd422265

SHA1
1304a9b781e2500262725a1dce85e1651dc7fc7a

SHA256
2531bbf2cd42ed2bae693b538301effeea0c60a5d14b05b32f5a5fea414cc233

SHA512
d8b16f69719689330a279b5e796e6d06fae241ca29fdd8e6945154b3983ead413d4be1065731937ce450de72d0805aa50041b0fd04ef65d1c577f32d2e3bd618

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
6750569a2d95ef0c565aad9d812e8674

SHA1
3fb29735ec5e34141d492d07f884d87a188a33b6

SHA256
b2cd4a986f311b1260cbb6012fc2017830550695440430315faef666eae06d69

SHA512
a1e69e90d385716a9185b5d491e76c99ebb1f9a97544cee1489cd164e11dcd1a3e2bd5993e8910cb0c30ae7e2818c99ca0689520debee31eeb8cfa5623f4cc42

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
c38a6844bc7e81220b457afe4dd6a7f6

SHA1
c7834628736608d72866ac024e14d7ba8ebb1dbf

SHA256
9939cc0be8e4963c44ffb9b5b6015cf7421612d28443a7ab00bf086ed8966551

SHA512
0c1e8cfcefe2bc0edcf6e9d9f302e4b9f52b7dd4fa6119b4aced88099df1b88d4ed371277525febad4705b386842b84f34836effb9898487bcc6fb2f00fdc724

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\update.exe

Filesize
72KB

MD5
7cab2403b8e4346c3886c4b7c15f1e18

SHA1
2d1191ea9605ad4378a71ed0c6044f69382ee2dc

SHA256
2c665ba855e4d62e4e681abdabb13d9df28257ff8581a6e818aa6f0b308d6c18

SHA512
d7d3c0aa301f63919346e5af2cbe16979173f9bed8aa20238892b7b32b84423f0ffa8b95f58f0c48df5b3ffd53f6b5f2bee3ed5a09c19e056affa5bacf1017cc

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
26b2506099912f3bd8644dd4345203d7

SHA1
a8593f1dc05507201a1aeace6b7061514b9c3080

SHA256
da2a999b0082aea3df93b9bb57f389e97cb79ec40356e1764aef929bfc95fcec

SHA512
550fc52d15073c213cd8688bbca44c61966cdbbd1f2f0e8d66c2c3ea0d4da02d3247958a80be1edbe400ef640431d12211e223d888b55219f6ce166c1981a92a

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2760_253052458\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
efbb92c9cb672b924fc2ec1cfcb132d6

SHA1
4f0f6c3331b3273f24c3b18c5c2efa8ce89f7649

SHA256
f23f8d2805417aab4a371dab28624c196c0d4d45ba8aaa5d760b130eae4e769f

SHA512
36254653575d6f8136acb7e99c4d5f891578b0d72391ec2243a46637e33624662ac6540f5e3c0a9fe317ac6188e2dec1491cfdc0575b1d3320ad96ea276e7914

Download Submit
memory/348-13318-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1196-10045-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/1520-12711-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1852-6615-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2120-11003-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2160-12182-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2304-11504-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2348-318-0x0000000077530000-0x000000007762A000-memory.dmp

Filesize
1000KB

Download
memory/2360-9664-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads