Malware Analysis Report

2025-01-06 12:00

Sample ID 240614-e72g9ayhjl
Target a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe
SHA256 a75cd894f491672596b8f46ce1c302fd1478de4215385ae2d34971e039f760ea
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a75cd894f491672596b8f46ce1c302fd1478de4215385ae2d34971e039f760ea

Threat Level: Known bad

The file a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

System policy modification

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 04:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 04:35

Reported

2024-06-14 04:38

Platform

win7-20240508-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\Office14\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Internet Explorer\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jre7\lib\management\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\he\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Multiplayer\Checkers\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Mozilla Firefox\uninstall\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre7\lib\cmm\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\VideoLAN\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Internet Explorer\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\addins\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Services\backup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\SysWOW64\0407\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\0409\update.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\040C\data.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\0C0A\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\ar-SA\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\0410\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\0411\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\AdvancedInstallers\backup.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\bg-BG\data.exe N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
File opened for modification C:\Program Files\Windows Media Player\es-ES\update.exe N/A N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\backup.exe N/A N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\backup.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe C:\Program Files\MSBuild\Microsoft\update.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\it-IT\backup.exe N/A N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\backup.exe C:\Program Files (x86)\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe C:\Program Files\Microsoft Games\Hearts\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe N/A N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe C:\Program Files (x86)\Google\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\backup.exe N/A N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\Help\data.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe C:\Program Files\Microsoft Games\Chess\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\Help\data.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\update.exe C:\Program Files\Java\jre7\lib\zi\backup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe C:\Program Files (x86)\Google\Update\backup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe C:\Program Files (x86)\Google\Update\Download\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\data.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe C:\Program Files\Java\jre7\lib\zi\America\backup.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\backup.exe N/A N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe N/A
File opened for modification C:\Program Files\Windows Mail\backup.exe C:\Program Files\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\backup.exe C:\Program Files (x86)\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\data.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe C:\Program Files\VideoLAN\VLC\locale\backup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\backup.exe N/A N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe C:\Program Files\Microsoft Games\Multiplayer\backup.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe N/A N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\backup.exe N/A N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\backup.exe N/A N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe N/A N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\backup.exe C:\Program Files (x86)\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\update.exe C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\inf\fr-FR\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\es\update.exe N/A N/A
File opened for modification C:\Windows\Resources\Themes\Aero\ja-JP\update.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MOF\it\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\data.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\backup.exe N/A N/A
File opened for modification C:\Windows\Panther\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_ja_31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\backup.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\fr-FR\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\it\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Activities\bf808b9c0c44745fc6bf261c44003c7a\backup.exe N/A N/A
File opened for modification C:\Windows\SoftwareDistribution\SelfUpdate\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\4f68cd04686e5dc5a55070d112d44bdf\update.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\aa3fa7748881ce0969396eba0be3c6c3\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCEx\6d4bacfd54e8f79763945bee5a50711d\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\MSDTC\0410\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiExtens\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\System Restore.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\backup.exe N/A N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vb0a86591#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1041\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\4782a5d2bc7d86895faf404a3470aacb\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\mcplayerinterop\backup.exe N/A N/A
File opened for modification C:\Windows\Resources\Ease of Access Themes\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\backup.exe N/A N/A
File opened for modification C:\Windows\inf\WmiApRpl\0009\data.exe N/A N/A
File opened for modification C:\Windows\AppPatch\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\7fce6bcd28750194d0343e473ad4f463\backup.exe N/A N/A
File opened for modification C:\Windows\inf\MSDTC Bridge 4.0.0.0\001F\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\data.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\backup.exe N/A N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\update.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe N/A N/A
File opened for modification C:\Windows\inf\ASP.NET\0001\System Restore.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\backup.exe N/A N/A
File opened for modification C:\Windows\inf\aspnet_state\0804\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\fcf5142785d58bbd7833d24cf9461961\backup.exe N/A N/A
File opened for modification C:\Windows\inf\PERFLIB\backup.exe N/A N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility\bbbbd997a1621cf1e739f922fe653459\backup.exe N/A N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\backup.exe N/A
N/A N/A C:\PerfLogs\Admin\backup.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe
PID 2740 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2740 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2740 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2740 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 2740 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2740 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2740 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2740 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 2740 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 2740 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
PID 2740 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
PID 2740 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
PID 2740 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe
PID 2716 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2716 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2716 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2716 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe
PID 2740 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe
PID 2740 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe
PID 2740 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe
PID 2740 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe
PID 2932 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2932 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2932 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2932 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe
PID 2740 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2740 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2740 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 2740 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1736 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1860 wrote to memory of 1996 N/A C:\backup.exe C:\PerfLogs\backup.exe
PID 1996 wrote to memory of 1744 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1996 wrote to memory of 1744 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe
PID 1996 wrote to memory of 1744 N/A C:\PerfLogs\backup.exe C:\PerfLogs\Admin\backup.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\VideoLAN\VLC\locale\is\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre7\lib\amd64\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Games\Mahjong\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Games\Solitaire\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Microsoft Analysis Services\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Public\Videos\Sample Videos\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" N/A N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\update.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe

C:\Users\Admin\AppData\Local\Temp\3249936127\update.exe C:\Users\Admin\AppData\Local\Temp\3249936127\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\data.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\CRX_INSTALL\

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\

C:\backup.exe

\backup.exe \

C:\PerfLogs\backup.exe

C:\PerfLogs\backup.exe C:\PerfLogs\

C:\PerfLogs\Admin\backup.exe

C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Program Files\Common Files\Microsoft Shared\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\

C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\data.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\

C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\

C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\

C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\

C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\update.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\

C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\

C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\

C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files\Common Files\SpeechEngines\backup.exe

"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe

"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\

C:\Program Files\Common Files\System\backup.exe

"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\

C:\Program Files\Common Files\System\ado\backup.exe

"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe

"C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files\Common Files\System\fr-FR\backup.exe

"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\System\it-IT\backup.exe

"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\System\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files\Common Files\System\msadc\backup.exe

"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\Common Files\System\Ole DB\backup.exe

"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Program Files\DVD Maker\backup.exe

"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\

C:\Program Files\DVD Maker\de-DE\backup.exe

"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\

C:\Program Files\DVD Maker\en-US\backup.exe

"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\

C:\Program Files\DVD Maker\es-ES\backup.exe

"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\

C:\Program Files\DVD Maker\fr-FR\backup.exe

"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\

C:\Program Files\DVD Maker\it-IT\data.exe

"C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\

C:\Program Files\DVD Maker\ja-JP\backup.exe

"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\

C:\Program Files\DVD Maker\Shared\backup.exe

"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\

C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\

C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\

C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\

C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\

C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\update.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\

C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\System Restore.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe

"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\

C:\Program Files\Google\backup.exe

"C:\Program Files\Google\backup.exe" C:\Program Files\Google\

C:\Program Files\Google\Chrome\backup.exe

"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\

C:\Program Files\Google\Chrome\Application\data.exe

"C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\data.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\data.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Program Files\Internet Explorer\System Restore.exe

"C:\Program Files\Internet Explorer\System Restore.exe" C:\Program Files\Internet Explorer\

C:\Program Files\Internet Explorer\de-DE\backup.exe

"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Program Files\Internet Explorer\en-US\backup.exe

"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Program Files\Internet Explorer\fr-FR\backup.exe

"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files\Internet Explorer\images\backup.exe

"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\

C:\Program Files\Internet Explorer\it-IT\backup.exe

"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Program Files\Internet Explorer\ja-JP\backup.exe

"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files\Java\jdk1.7.0_80\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\

C:\Program Files\Java\jdk1.7.0_80\db\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\

C:\Program Files\Java\jdk1.7.0_80\include\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\data.exe

"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\data.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\

C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\

C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\data.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\

C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\System Restore.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\

C:\Program Files (x86)\backup.exe

"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\

C:\Program Files (x86)\Adobe\Reader 9.0\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\update.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\update.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\data.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\data.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\

C:\Program Files (x86)\Common Files\Adobe AIR\data.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\

C:\Program Files (x86)\Common Files\DESIGNER\System Restore.exe

"C:\Program Files (x86)\Common Files\DESIGNER\System Restore.exe" C:\Program Files (x86)\Common Files\DESIGNER\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\

C:\Program Files\Java\jre7\data.exe

"C:\Program Files\Java\jre7\data.exe" C:\Program Files\Java\jre7\

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\

C:\Program Files\Java\jre7\bin\backup.exe

"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\

C:\Program Files\Java\jre7\bin\dtplugin\data.exe

"C:\Program Files\Java\jre7\bin\dtplugin\data.exe" C:\Program Files\Java\jre7\bin\dtplugin\

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\

C:\Program Files\Java\jre7\bin\plugin2\backup.exe

"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\

C:\Program Files\Java\jre7\bin\server\backup.exe

"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\

C:\Program Files\Java\jre7\lib\backup.exe

"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\

C:\Program Files\Java\jre7\lib\amd64\update.exe

"C:\Program Files\Java\jre7\lib\amd64\update.exe" C:\Program Files\Java\jre7\lib\amd64\

C:\Program Files (x86)\Common Files\microsoft shared\Help\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\

C:\Program Files\Java\jre7\lib\applet\backup.exe

"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\

C:\Program Files\Java\jre7\lib\cmm\backup.exe

"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\

C:\Program Files\Java\jre7\lib\deploy\backup.exe

"C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\

C:\Program Files\Java\jre7\lib\ext\backup.exe

"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\

C:\Program Files\Java\jre7\lib\fonts\backup.exe

"C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\

C:\Program Files\Java\jre7\lib\images\backup.exe

"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe

"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\

C:\Program Files\Java\jre7\lib\jfr\data.exe

"C:\Program Files\Java\jre7\lib\jfr\data.exe" C:\Program Files\Java\jre7\lib\jfr\

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\

C:\Program Files\Java\jre7\lib\management\System Restore.exe

"C:\Program Files\Java\jre7\lib\management\System Restore.exe" C:\Program Files\Java\jre7\lib\management\

C:\Program Files\Java\jre7\lib\security\backup.exe

"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\

C:\Program Files\Java\jre7\lib\zi\backup.exe

"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\

C:\Program Files\Java\jre7\lib\zi\America\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\

C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe

"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\

C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\

C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe

"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\

C:\Program Files\Java\jre7\lib\zi\Pacific\update.exe

"C:\Program Files\Java\jre7\lib\zi\Pacific\update.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe

"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files\Microsoft Games\backup.exe

"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files\Microsoft Games\Chess\backup.exe

"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Microsoft Games\Chess\en-US\System Restore.exe

"C:\Program Files\Microsoft Games\Chess\en-US\System Restore.exe" C:\Program Files\Microsoft Games\Chess\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe

"C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Chess\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\

C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\

C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\

C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\

C:\Program Files\Microsoft Games\FreeCell\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\

C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\

C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\

C:\Program Files\Microsoft Games\FreeCell\it-IT\System Restore.exe

"C:\Program Files\Microsoft Games\FreeCell\it-IT\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\

C:\Program Files\Microsoft Games\Hearts\backup.exe

"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\

C:\Program Files\Microsoft Games\Hearts\de-DE\data.exe

"C:\Program Files\Microsoft Games\Hearts\de-DE\data.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe

"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\

C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\

C:\Program Files\Microsoft Games\Mahjong\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\

C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\

C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\

C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\

C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\

C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\

C:\Program Files\Microsoft Games\Minesweeper\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\

C:\Program Files\Microsoft Games\Minesweeper\en-US\System Restore.exe

"C:\Program Files\Microsoft Games\Minesweeper\en-US\System Restore.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\System Restore.exe

"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\System Restore.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\

C:\Program Files\Microsoft Games\Minesweeper\it-IT\update.exe

"C:\Program Files\Microsoft Games\Minesweeper\it-IT\update.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\

C:\Program Files\Microsoft Games\More Games\backup.exe

"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe

"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\

C:\Program Files\Microsoft Games\More Games\en-US\backup.exe

"C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe

"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\

C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe

"C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\

C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\

C:\Program Files\Microsoft Games\Multiplayer\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\update.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\

C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\System Restore.exe

"C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\update.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\

C:\Program Files\Microsoft Games\Purble Place\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\

C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\

C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\

C:\Program Files\Microsoft Games\Purble Place\es-ES\System Restore.exe

"C:\Program Files\Microsoft Games\Purble Place\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\

C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\

C:\Program Files\Microsoft Games\Purble Place\ja-JP\System Restore.exe

"C:\Program Files\Microsoft Games\Purble Place\ja-JP\System Restore.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\

C:\Program Files\Microsoft Games\Solitaire\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\

C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\

C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\

C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\

C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\

C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\

C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\System Restore.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\

C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe

"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\

C:\Program Files\Microsoft Office\Office14\backup.exe

"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\

C:\Program Files\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\

C:\Program Files\Mozilla Firefox\System Restore.exe

"C:\Program Files\Mozilla Firefox\System Restore.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\

C:\Program Files\Mozilla Firefox\browser\backup.exe

"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Program Files\Mozilla Firefox\defaults\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\

C:\Program Files\Mozilla Firefox\fonts\data.exe

"C:\Program Files\Mozilla Firefox\fonts\data.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\

C:\Program Files\Mozilla Firefox\uninstall\update.exe

"C:\Program Files\Mozilla Firefox\uninstall\update.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\

C:\Program Files\MSBuild\Microsoft\update.exe

"C:\Program Files\MSBuild\Microsoft\update.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\update.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\data.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\

C:\Program Files\VideoLAN\VLC\backup.exe

"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\

C:\Program Files\VideoLAN\VLC\locale\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\

C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe

"C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\

C:\Program Files\VideoLAN\VLC\locale\af\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\

C:\Program Files (x86)\Common Files\Services\backup.exe

"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe

"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\backup.exe

"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\

C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\

C:\Program Files (x86)\Common Files\System\ado\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\

C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ar\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\data.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Users\Admin\Contacts\backup.exe

C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Program Files\VideoLAN\VLC\locale\be\data.exe

"C:\Program Files\VideoLAN\VLC\locale\be\data.exe" C:\Program Files\VideoLAN\VLC\locale\be\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Users\Admin\Documents\backup.exe

C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Users\Admin\Downloads\backup.exe

C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\

C:\Users\Admin\Links\backup.exe

C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\

C:\Program Files (x86)\Common Files\System\msadc\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\System Restore.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\System Restore.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Users\Admin\Saved Games\backup.exe

"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\

C:\Users\Admin\Videos\backup.exe

C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\

C:\Users\Public\update.exe

C:\Users\Public\update.exe C:\Users\Public\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\System Restore.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\

C:\Users\Public\Documents\backup.exe

C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\

C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\

C:\Users\Public\Downloads\backup.exe

C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe

"C:\Program Files (x86)\Common Files\System\MSMAPI\1033\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\1033\

C:\Users\Public\Music\backup.exe

C:\Users\Public\Music\backup.exe C:\Users\Public\Music\

C:\Program Files\VideoLAN\VLC\locale\bs\update.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\update.exe" C:\Program Files\VideoLAN\VLC\locale\bs\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Users\Public\Music\Sample Music\backup.exe

"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Users\Public\Pictures\backup.exe

C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\

C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Users\Public\Pictures\Sample Pictures\backup.exe

"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Users\Public\Recorded TV\backup.exe

"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Users\Public\Recorded TV\Sample Media\backup.exe

"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\

C:\Program Files\VideoLAN\VLC\locale\ca@valencia\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\

C:\Users\Public\Videos\Sample Videos\backup.exe

"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Windows\backup.exe

C:\Windows\backup.exe C:\Windows\

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\

C:\Windows\addins\backup.exe

C:\Windows\addins\backup.exe C:\Windows\addins\

C:\Program Files (x86)\Google\CrashReports\backup.exe

"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Program Files\VideoLAN\VLC\locale\co\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\

C:\Windows\AppCompat\backup.exe

C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\

C:\Windows\AppPatch\backup.exe

C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\

C:\Program Files (x86)\Google\Temp\backup.exe

"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\

C:\Windows\AppPatch\AppPatch64\backup.exe

C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\

C:\Program Files (x86)\Google\Update\backup.exe

"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\

C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\

C:\Windows\AppPatch\Custom\backup.exe

C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\update.exe

"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\

C:\Windows\AppPatch\Custom\Custom64\backup.exe

C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\

C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\

C:\Program Files (x86)\Google\Update\Download\backup.exe

"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Windows\AppPatch\de-DE\backup.exe

C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\

C:\Windows\AppPatch\en-US\backup.exe

C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\

C:\Program Files (x86)\Google\Update\Install\backup.exe

"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Program Files\VideoLAN\VLC\locale\da\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\

C:\Windows\AppPatch\es-ES\backup.exe

C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\

C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\

C:\Windows\AppPatch\fr-FR\backup.exe

C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Program Files\VideoLAN\VLC\locale\de\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\

C:\Windows\AppPatch\it-IT\backup.exe

C:\Windows\AppPatch\it-IT\backup.exe C:\Windows\AppPatch\it-IT\

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Windows\AppPatch\ja-JP\backup.exe

C:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\el\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe

"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Windows\assembly\GAC\ADODB\backup.exe

C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\

C:\Program Files (x86)\Internet Explorer\it-IT\data.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\data.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\

C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eo\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eo\

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Analysis Services\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\

C:\Program Files\VideoLAN\VLC\locale\es\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es_MX\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\

C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\

C:\Windows\assembly\GAC\mscomctl\backup.exe

C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe

"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\

C:\Program Files\VideoLAN\VLC\locale\et\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\backup.exe

"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\

C:\Windows\assembly\GAC\MSDATASRC\System Restore.exe

"C:\Windows\assembly\GAC\MSDATASRC\System Restore.exe" C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\

C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\

C:\Windows\assembly\GAC\stdole\data.exe

C:\Windows\assembly\GAC\stdole\data.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\

C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\

C:\Windows\assembly\GAC_32\backup.exe

C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\

C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe

"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\System Restore.exe

"C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\System Restore.exe" C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\

C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\

C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\System Restore.exe

"C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\

C:\Program Files\VideoLAN\VLC\locale\fi\update.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\update.exe" C:\Program Files\VideoLAN\VLC\locale\fi\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe

"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\

C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\

C:\Windows\assembly\GAC_32\ehexthost32\data.exe

C:\Windows\assembly\GAC_32\ehexthost32\data.exe C:\Windows\assembly\GAC_32\ehexthost32\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\

C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\

C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\

C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe

C:\Windows\assembly\GAC_32\mcstoredb\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\

C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe

"C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\

C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\

C:\Program Files (x86)\Microsoft Office\Office14\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\

C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\update.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\update.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\System Restore.exe

"C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\System Restore.exe

"C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\

C:\Program Files\VideoLAN\VLC\locale\he\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\

C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\

C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\

C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\

C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\

C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\

C:\Program Files\VideoLAN\VLC\locale\id\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\backup.exe C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\

C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ie\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ie\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\

C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\System Restore.exe

"C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\

C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\System Restore.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\

C:\Program Files\VideoLAN\VLC\locale\is\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\data.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\data.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\update.exe

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\update.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\

C:\Program Files\VideoLAN\VLC\locale\it\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\

C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\1036\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\1036\

C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\

C:\Windows\assembly\GAC_32\MSBuild\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\

C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\3082\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\3082\

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\

C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\

C:\Windows\assembly\GAC_32\mscorlib\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\

C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files\VideoLAN\VLC\locale\kab\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kab\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kab\

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe

"C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\

C:\Windows\assembly\GAC_32\napcrypt\backup.exe

C:\Windows\assembly\GAC_32\napcrypt\backup.exe C:\Windows\assembly\GAC_32\napcrypt\

C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\

C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3249936127\update.exe

MD5 ce9075d1fa548edb3f0e6be42f42538a
SHA1 ab09e148dd6e0589bcfd22ea7685bc8540f43f28
SHA256 5f5fe66f1a7e0bc53bcfbbf28a47251db8ec0a12f14583017d7f1640c380df83
SHA512 37dd7b17e8d99a48cfeb57e890745ef2e815c3794690813fe81679d39811bc14a7956253211263bf7186da9d014b860ec0a9a138d631cbbb832af629abe7d6d0

C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\CRX_INSTALL\backup.exe

MD5 4e07461b1e0df478ebe0a1ec3b709a9c
SHA1 79013abea41a686666f0488b149e83b2fe380c01
SHA256 935936e85100d7076397874d7dc6252fd45fb7ecc46264ef3dbd5c7245073296
SHA512 6325371fe8da118a4748e850efe165e504871a7600b77d0d3eb3b46d5d92c6acdaf9479523c0f1d949cc8a7dd8fb06402ee015821b6ce74e4d885bdf79c2c499

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 c5bf2e8bdf9e14071aeac642a382b9c1
SHA1 fc2468885caf2d0113fc9491f3194c8563836539
SHA256 cd30b21125fae73c60fb4e6317c4f7d3da230e7eed1e8b03857b86d7284db7b3
SHA512 4b679e2fbdc7085957b5ef5e04b841078cf7c32c723c110d3c5c40cea46d9ddf9a48342eae4e3cfce7d6e371c95a3c05c59b28053ad9701a9929d693b06dd16c

C:\backup.exe

MD5 a66d167c0cd96ca6c8de8f1d126c8ba2
SHA1 6cd743b6f52a96ab0e6709585b8f6fe4078d4b2d
SHA256 3c69eebcabdbe29e170ac16cf039b3b98ef20770ed364302a4f670adf371f8d2
SHA512 ecf33107bc5337cf323315fb5d93aaa23a0b48b4b1ed21df901cdc1ebe6067f25dedc277179649e789181d3578d428f04c1214a4c18045abd6267dd93a357120

\PerfLogs\backup.exe

MD5 1270f8dc0362c2bb23a900ed5a8a49c2
SHA1 6cacea2f30c89f8540a25050f5805bc61868daf0
SHA256 cd3164986fe4e59f7f10703022372e520dd6c9fdf24f720b859b78a9e0dd401d
SHA512 e34ab47c3bde137868067e27c8425dbb3b19524029729804553fc3cd6bbee4d8cf756accc7410a3c4d4e1a18ae3d7be7c3d1a6b6d38e564736423d1e92e30100

\PerfLogs\Admin\backup.exe

MD5 492c72982eb899c46722e6b4ef3ebc2f
SHA1 07d44d81ab66ab515a49aa454e0e9a11b718b56d
SHA256 4e44eed8959043e87ef1e95a3b4760524e7097695e03784c6ea5bfd127d8cbc5
SHA512 603844ecfc7f37269427db00e820e9ad27fa4041125d1d955e8854fd535a894a63388176374a5996638eb68ad82cd0811b6bda6f02b55b13626712e15cfd26d3

memory/1304-912-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2744-2793-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2644-3028-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2644-3029-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1672-3194-0x00000000002E0000-0x00000000002F0000-memory.dmp

memory/2736-3415-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2828-3483-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/2152-3578-0x0000000000260000-0x0000000000270000-memory.dmp

memory/1004-3592-0x0000000000260000-0x0000000000270000-memory.dmp

memory/1852-3711-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1852-3712-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2684-3733-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2684-3734-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2664-3937-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/2664-3936-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/2592-3948-0x0000000000350000-0x0000000000360000-memory.dmp

memory/2728-3955-0x00000000003E0000-0x00000000003F0000-memory.dmp

memory/2040-3976-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2040-3977-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2124-4101-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1180-4118-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2124-4405-0x00000000001E0000-0x00000000001F0000-memory.dmp

memory/2124-4409-0x00000000001E0000-0x00000000001F0000-memory.dmp

memory/1816-4526-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2916-4622-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/1392-4772-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2216-5597-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2836-5723-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2836-5722-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2972-5757-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2972-5759-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1304-5764-0x0000000077750000-0x000000007784A000-memory.dmp

memory/1304-5763-0x0000000077850000-0x000000007796F000-memory.dmp

memory/1808-6112-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1808-6110-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1304-7198-0x0000000077850000-0x000000007796F000-memory.dmp

memory/1304-7199-0x0000000077750000-0x000000007784A000-memory.dmp

memory/1808-7550-0x0000000000430000-0x0000000000440000-memory.dmp

memory/1304-8092-0x0000000077750000-0x000000007784A000-memory.dmp

memory/2312-8098-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2312-8097-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1304-8096-0x0000000002A70000-0x0000000002B80000-memory.dmp

memory/1304-8091-0x0000000077850000-0x000000007796F000-memory.dmp

memory/2460-8514-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2460-8515-0x0000000000250000-0x0000000000260000-memory.dmp

memory/2008-8829-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2564-9340-0x0000000000260000-0x0000000000270000-memory.dmp

memory/2288-11258-0x0000000000270000-0x0000000000280000-memory.dmp

memory/2196-11531-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2196-11529-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2352-11577-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2352-11576-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1628-11934-0x0000000000220000-0x0000000000230000-memory.dmp

memory/572-12111-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/976-12175-0x0000000000240000-0x0000000000250000-memory.dmp

memory/1628-12213-0x0000000000220000-0x0000000000230000-memory.dmp

memory/760-12719-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1864-12744-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2516-12835-0x0000000000250000-0x0000000000260000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 04:35

Reported

2024-06-14 04:38

Platform

win10v2004-20240508-en

Max time kernel

34s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\VSTO\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Mozilla Firefox\fonts\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\System\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\OneDrive\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\legal\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\appcompat\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\apppatch\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\Services\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Java\jdk-1.8\lib\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\fre\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\AppReadiness\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\System\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Searches\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\Updates\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\Updates\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Mozilla Firefox\uninstall\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\ado\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\msadc\en-US\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Downloads\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\loc\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\host\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Internet Explorer\images\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\Office16\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC\stdole\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Google\CrashReports\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\System\ado\de-DE\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Java\jre-1.8\bin\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Music\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\apppatch\AppPatch64\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Public\Music\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\update.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\data.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\update.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\System Restore.exe C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe C:\Program Files\Microsoft Office\root\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\backup.exe C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\update.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe C:\Program Files\Java\jre-1.8\lib\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe N/A
File opened for modification C:\Program Files\ModifiableWindowsApps\backup.exe C:\Program Files\backup.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\backup.exe C:\Program Files\7-Zip\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe C:\Program Files\Java\jre-1.8\legal\backup.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\management\backup.exe C:\Program Files\Java\jre-1.8\lib\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe C:\Program Files\Microsoft Office\root\Office16\backup.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe C:\Program Files\Microsoft Office\root\Office16\backup.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe C:\Program Files\Google\Chrome\System Restore.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe C:\Program Files (x86)\Common Files\Java\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe C:\Program Files\Microsoft Office\root\Office16\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe C:\Program Files\Common Files\System\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe C:\Program Files (x86)\Google\Update\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\data.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\System Restore.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\System Restore.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe C:\Program Files\Common Files\System\backup.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\backup.exe C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe C:\Program Files\Microsoft Office\root\Office16\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\backup.exe C:\Program Files\Common Files\System\msadc\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe C:\Program Files (x86)\Common Files\Adobe\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\backup.exe C:\Program Files\Java\jdk-1.8\backup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\backup.exe C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\backup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe N/A
File opened for modification C:\Windows\addins\System Restore.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\appcompat\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Ink\System Restore.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\backup.exe C:\backup.exe N/A
File opened for modification C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\backup.exe N/A
File opened for modification C:\Windows\assembly\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\data.exe N/A
File opened for modification C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\backup.exe N/A
File opened for modification C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\System Restore.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe N/A
File opened for modification C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC\mscomctl\data.exe C:\Windows\assembly\GAC\backup.exe N/A
File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\backup.exe N/A
File opened for modification C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\backup.exe C:\Windows\backup.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe N/A
File opened for modification C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\backup.exe N/A
File opened for modification C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\backup.exe N/A
File opened for modification C:\Windows\AppReadiness\backup.exe C:\Windows\backup.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Low\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe N/A
N/A N/A C:\backup.exe N/A
N/A N/A C:\PerfLogs\update.exe N/A
N/A N/A C:\Program Files\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\backup.exe N/A
N/A N/A C:\Program Files\7-Zip\Lang\backup.exe N/A
N/A N/A C:\Program Files\Common Files\backup.exe N/A
N/A N/A C:\Program Files\Common Files\DESIGNER\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\update.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe N/A
N/A N/A C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4532 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe
PID 4532 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe
PID 4532 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe
PID 4532 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe
PID 4532 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe
PID 4532 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe
PID 4532 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 4532 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 4532 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
PID 4532 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 4532 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 4532 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
PID 4532 wrote to memory of 6088 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 4532 wrote to memory of 6088 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 4532 wrote to memory of 6088 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
PID 4532 wrote to memory of 5496 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 5496 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 5496 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
PID 4532 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
PID 4532 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
PID 4532 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
PID 4532 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 4532 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 4532 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
PID 5116 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 5116 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 5116 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
PID 1140 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 1140 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 1140 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
PID 3908 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe C:\backup.exe
PID 3908 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe C:\backup.exe
PID 3908 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe C:\backup.exe
PID 368 wrote to memory of 4104 N/A C:\backup.exe C:\PerfLogs\update.exe
PID 368 wrote to memory of 4104 N/A C:\backup.exe C:\PerfLogs\update.exe
PID 368 wrote to memory of 4104 N/A C:\backup.exe C:\PerfLogs\update.exe
PID 368 wrote to memory of 1416 N/A C:\backup.exe C:\Program Files\backup.exe
PID 368 wrote to memory of 1416 N/A C:\backup.exe C:\Program Files\backup.exe
PID 368 wrote to memory of 1416 N/A C:\backup.exe C:\Program Files\backup.exe
PID 1416 wrote to memory of 3188 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1416 wrote to memory of 3188 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 1416 wrote to memory of 3188 N/A C:\Program Files\backup.exe C:\Program Files\7-Zip\backup.exe
PID 3188 wrote to memory of 1900 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 3188 wrote to memory of 1900 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 3188 wrote to memory of 1900 N/A C:\Program Files\7-Zip\backup.exe C:\Program Files\7-Zip\Lang\backup.exe
PID 1416 wrote to memory of 5220 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 1416 wrote to memory of 5220 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 1416 wrote to memory of 5220 N/A C:\Program Files\backup.exe C:\Program Files\Common Files\backup.exe
PID 5220 wrote to memory of 3632 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 5220 wrote to memory of 3632 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 5220 wrote to memory of 3632 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\DESIGNER\backup.exe
PID 5220 wrote to memory of 2932 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 5220 wrote to memory of 2932 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 5220 wrote to memory of 2932 N/A C:\Program Files\Common Files\backup.exe C:\Program Files\Common Files\microsoft shared\backup.exe
PID 2932 wrote to memory of 4424 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
PID 2932 wrote to memory of 4424 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
PID 2932 wrote to memory of 4424 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
PID 2932 wrote to memory of 1980 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
PID 2932 wrote to memory of 1980 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
PID 2932 wrote to memory of 1980 N/A C:\Program Files\Common Files\microsoft shared\backup.exe C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
PID 1980 wrote to memory of 3344 N/A C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Public\Videos\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\VC\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\Office16\1033\update.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Internet Explorer\SIGNUP\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Microsoft Office\root\Licenses\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\System\msadc\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Java\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Google\Update\Install\System Restore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Windows\assembly\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\Videos\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Common Files\System\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\AppReadiness\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\update.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Google\Update\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files (x86)\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\assembly\GAC\ADODB\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files (x86)\Google\Update\Download\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\backup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Program Files\Java\jre-1.8\lib\security\backup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a27fe0b73217c8c664a482b36f811530_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe

C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\

C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe

C:\Users\Admin\AppData\Local\Temp\1790026277\backup.exe C:\Users\Admin\AppData\Local\Temp\1790026277\

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\

C:\backup.exe

\backup.exe \

C:\PerfLogs\update.exe

C:\PerfLogs\update.exe C:\PerfLogs\

C:\Program Files\backup.exe

"C:\Program Files\backup.exe" C:\Program Files\

C:\Program Files\7-Zip\backup.exe

"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\

C:\Program Files\7-Zip\Lang\backup.exe

"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\

C:\Program Files\Common Files\backup.exe

"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\

C:\Program Files\Common Files\DESIGNER\backup.exe

"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\

C:\Program Files\Common Files\microsoft shared\backup.exe

"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\

C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe

"C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\

C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\

C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\

C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\

C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\

C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\

C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\

C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\

C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\

C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\update.exe

"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\

C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\

C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\

C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\

C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\

C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\

C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\

C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\

C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\

C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\

C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\

C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\

C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\

C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\

C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\

C:\Program Files\Common Files\microsoft shared\ink\sl-SI\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\sl-SI\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\

C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\

C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\

C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\

C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\

C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe

"C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\

C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\

C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\

C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\

C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\

C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\

C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\

C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\

C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe

"C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\

C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe

"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe

"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\

C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe

"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\

C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe

"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\

C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\

C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\

C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe

"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\

C:\Program Files\Common Files\microsoft shared\VC\backup.exe

"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\

C:\Program Files\Common Files\microsoft shared\VGX\backup.exe

"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\

C:\Program Files\Common Files\microsoft shared\VSTO\data.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\data.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe

"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\

C:\Program Files\Common Files\Services\backup.exe

"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\

C:\Program Files\Common Files\System\backup.exe

"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\

C:\Program Files\Common Files\System\ado\data.exe

"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\

C:\Program Files\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\

C:\Program Files\Common Files\System\ado\en-US\backup.exe

"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\

C:\Program Files\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\

C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe

"C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe" C:\Program Files\Common Files\System\ado\it-IT\

C:\Program Files\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\

C:\Program Files\Common Files\System\de-DE\backup.exe

"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\

C:\Program Files\Common Files\System\en-US\backup.exe

"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\

C:\Program Files\Common Files\System\es-ES\backup.exe

"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\

C:\Program Files\Common Files\System\fr-FR\backup.exe

"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\

C:\Program Files\Common Files\System\it-IT\backup.exe

"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\

C:\Program Files\Common Files\System\ja-JP\backup.exe

"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\

C:\Program Files\Common Files\System\msadc\backup.exe

"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\

C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe

"C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe" C:\Program Files\Common Files\System\msadc\de-DE\

C:\Program Files\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\

C:\Program Files\Common Files\System\Ole DB\backup.exe

"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\

C:\Program Files\Common Files\System\uk-UA\backup.exe

"C:\Program Files\Common Files\System\uk-UA\backup.exe" C:\Program Files\Common Files\System\uk-UA\

C:\Program Files\dotnet\backup.exe

"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\

C:\Program Files\dotnet\host\backup.exe

"C:\Program Files\dotnet\host\backup.exe" C:\Program Files\dotnet\host\

C:\Program Files\dotnet\host\fxr\backup.exe

"C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\

C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe

"C:\Program Files\dotnet\host\fxr\6.0.27\backup.exe" C:\Program Files\dotnet\host\fxr\6.0.27\

C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe

"C:\Program Files\dotnet\host\fxr\7.0.16\backup.exe" C:\Program Files\dotnet\host\fxr\7.0.16\

C:\Program Files\dotnet\host\fxr\8.0.2\backup.exe

"C:\Program Files\dotnet\host\fxr\8.0.2\backup.exe" C:\Program Files\dotnet\host\fxr\8.0.2\

C:\Program Files\dotnet\shared\backup.exe

"C:\Program Files\dotnet\shared\backup.exe" C:\Program Files\dotnet\shared\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\backup.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System Restore.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System Restore.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System Restore.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\update.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\data.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\data.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\backup.exe

"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\

C:\Program Files\dotnet\swidtag\backup.exe

"C:\Program Files\dotnet\swidtag\backup.exe" C:\Program Files\dotnet\swidtag\

C:\Program Files\Google\System Restore.exe

"C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\

C:\Program Files\Google\Chrome\System Restore.exe

"C:\Program Files\Google\Chrome\System Restore.exe" C:\Program Files\Google\Chrome\

C:\Program Files\Google\Chrome\Application\backup.exe

"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\

C:\Program Files (x86)\backup.exe

"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\backup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\

C:\Program Files (x86)\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\

C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\System Restore.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\System Restore.exe" C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe

"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\

C:\Program Files\Internet Explorer\backup.exe

"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\

C:\Program Files\Internet Explorer\de-DE\backup.exe

"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\

C:\Program Files\Internet Explorer\en-US\backup.exe

"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\

C:\Program Files\Internet Explorer\es-ES\backup.exe

"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\

C:\Program Files\Internet Explorer\fr-FR\backup.exe

"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\

C:\Program Files\Internet Explorer\images\backup.exe

"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\

C:\Program Files\Internet Explorer\it-IT\data.exe

"C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\

C:\Program Files\Internet Explorer\ja-JP\data.exe

"C:\Program Files\Internet Explorer\ja-JP\data.exe" C:\Program Files\Internet Explorer\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\

C:\Program Files\Internet Explorer\SIGNUP\data.exe

"C:\Program Files\Internet Explorer\SIGNUP\data.exe" C:\Program Files\Internet Explorer\SIGNUP\

C:\Program Files\Internet Explorer\uk-UA\backup.exe

"C:\Program Files\Internet Explorer\uk-UA\backup.exe" C:\Program Files\Internet Explorer\uk-UA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\

C:\Program Files\Java\backup.exe

"C:\Program Files\Java\backup.exe" C:\Program Files\Java\

C:\Program Files\Java\jdk-1.8\backup.exe

"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\

C:\Program Files\Java\jdk-1.8\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\

C:\Program Files\Java\jdk-1.8\include\backup.exe

"C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\

C:\Program Files\Java\jdk-1.8\include\win32\backup.exe

"C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\

C:\Program Files\Java\jdk-1.8\include\win32\bridge\System Restore.exe

"C:\Program Files\Java\jdk-1.8\include\win32\bridge\System Restore.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\

C:\Program Files\Java\jdk-1.8\jre\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\

C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\

C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\

C:\Program Files\Java\jdk-1.8\jre\bin\server\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\bin\server\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\

C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\

C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\

C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\

C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\

C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\

C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\

C:\Program Files\Java\jdk-1.8\jre\lib\cmm\data.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\data.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\

C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\

C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\

C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\

C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\

C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\

C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\

C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\

C:\Program Files\Java\jdk-1.8\legal\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\

C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\

C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\

C:\Program Files\Java\jdk-1.8\lib\backup.exe

"C:\Program Files\Java\jdk-1.8\lib\backup.exe" C:\Program Files\Java\jdk-1.8\lib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\

C:\Program Files\Java\jre-1.8\backup.exe

"C:\Program Files\Java\jre-1.8\backup.exe" C:\Program Files\Java\jre-1.8\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\

C:\Program Files\Java\jre-1.8\bin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\

C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe

"C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\

C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe

"C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\

C:\Program Files\Java\jre-1.8\bin\server\backup.exe

"C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\

C:\Program Files\Java\jre-1.8\legal\backup.exe

"C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\

C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe

"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\

C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe

"C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\

C:\Program Files\Java\jre-1.8\lib\backup.exe

"C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\

C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe

"C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\

C:\Program Files\Java\jre-1.8\lib\applet\backup.exe

"C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\

C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe

"C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\

C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe

"C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\

C:\Program Files\Java\jre-1.8\lib\ext\backup.exe

"C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\

C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe

"C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\

C:\Program Files\Java\jre-1.8\lib\images\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\

C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe

"C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\

C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe

"C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe" C:\Program Files\Java\jre-1.8\lib\jfr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\

C:\Program Files\Java\jre-1.8\lib\management\backup.exe

"C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\

C:\Program Files\Java\jre-1.8\lib\security\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\

C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\

C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe

"C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\

C:\Program Files\Java\jre8\backup.exe

"C:\Program Files\Java\jre8\backup.exe" C:\Program Files\Java\jre8\

C:\Program Files\Java\jre8\lib\backup.exe

"C:\Program Files\Java\jre8\lib\backup.exe" C:\Program Files\Java\jre8\lib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\

C:\Program Files\Microsoft Office\backup.exe

"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\

C:\Program Files\Microsoft Office\Office16\backup.exe

"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\

C:\Program Files\Microsoft Office\PackageManifests\backup.exe

"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\

C:\Program Files\Microsoft Office\root\backup.exe

"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\

C:\Program Files\Microsoft Office\root\Client\backup.exe

"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\

C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\update.exe

"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\update.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\

C:\Program Files\Microsoft Office\root\fre\backup.exe

"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\

C:\Program Files\Microsoft Office\root\Integration\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\

C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe

"C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\

C:\Program Files\Microsoft Office\root\Licenses\backup.exe

"C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\

C:\Program Files\Microsoft Office\root\Licenses16\backup.exe

"C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\

C:\Program Files\Microsoft Office\root\loc\update.exe

"C:\Program Files\Microsoft Office\root\loc\update.exe" C:\Program Files\Microsoft Office\root\loc\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\

C:\Program Files\Microsoft Office\root\Office15\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office15\System Restore.exe" C:\Program Files\Microsoft Office\root\Office15\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\

C:\Program Files\Microsoft Office\root\Office16\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\

C:\Program Files\Microsoft Office\root\Office16\1033\update.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\update.exe" C:\Program Files\Microsoft Office\root\Office16\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\

C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\

C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\data.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\data.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\

C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\

C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1036\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\

C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\data.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\data.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\

C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\

C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\

C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Configuration\

C:\Users\backup.exe

C:\Users\backup.exe C:\Users\

C:\Program Files (x86)\Common Files\backup.exe

"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\

C:\Users\Admin\backup.exe

C:\Users\Admin\backup.exe C:\Users\Admin\

C:\Program Files (x86)\Common Files\Adobe\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\

C:\Users\Admin\3D Objects\backup.exe

"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\

C:\Users\Admin\Contacts\System Restore.exe

"C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\

C:\Program Files\Microsoft Office\root\Office16\FPA_f14\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f14\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\

C:\Program Files (x86)\Common Files\Adobe\ARM\update.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\update.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\

C:\Users\Admin\Desktop\backup.exe

C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\

C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\

C:\Users\Admin\Documents\backup.exe

C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\

C:\Users\Admin\Documents\OneNote Notebooks\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\

C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f3\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe

"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\

C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\

C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f33\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\

C:\Users\Admin\Downloads\backup.exe

C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\

C:\Program Files\Microsoft Office\root\Office16\FPA_f4\update.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f4\update.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f4\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\

C:\Users\Admin\Favorites\backup.exe

C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\

C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_f7\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f7\

C:\Users\Admin\Links\backup.exe

C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\

C:\Users\Admin\Music\backup.exe

C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\data.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\

C:\Users\Admin\OneDrive\backup.exe

C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\System Restore.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\

C:\Users\Admin\Pictures\backup.exe

C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\

C:\Users\Admin\Pictures\Camera Roll\backup.exe

"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\

C:\Users\Admin\Pictures\Saved Pictures\backup.exe

"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\

C:\Users\Admin\Saved Games\backup.exe

"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\

C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\

C:\Users\Admin\Searches\backup.exe

C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\

C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\FPA_w1\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_w1\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\

C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\

C:\Users\Admin\Videos\backup.exe

C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\

C:\Users\Public\backup.exe

C:\Users\Public\backup.exe C:\Users\Public\

C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\

C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\

C:\Users\Public\Documents\backup.exe

C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\

C:\Users\Public\Downloads\backup.exe

C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\

C:\Users\Public\Music\backup.exe

C:\Users\Public\Music\backup.exe C:\Users\Public\Music\

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\

C:\Users\Public\Pictures\backup.exe

C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\

C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\System Restore.exe

"C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\

C:\Users\Public\Videos\backup.exe

C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\

C:\Program Files\Microsoft Office\root\Office16\LogoImages\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\LogoImages\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LogoImages\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\

C:\Windows\backup.exe

C:\Windows\backup.exe C:\Windows\

C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MEDIA\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\System Restore.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\

C:\Windows\addins\System Restore.exe

"C:\Windows\addins\System Restore.exe" C:\Windows\addins\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\

C:\Windows\appcompat\backup.exe

C:\Windows\appcompat\backup.exe C:\Windows\appcompat\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\

C:\Windows\appcompat\appraiser\backup.exe

C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe

"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\

C:\Windows\appcompat\appraiser\Telemetry\backup.exe

C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\

C:\Program Files (x86)\Common Files\Java\backup.exe

"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\

C:\Windows\appcompat\encapsulation\backup.exe

C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe

"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\

C:\Windows\appcompat\Programs\backup.exe

C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\

C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\

C:\Windows\apppatch\backup.exe

C:\Windows\apppatch\backup.exe C:\Windows\apppatch\

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\

C:\Windows\apppatch\AppPatch64\backup.exe

C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\

C:\Windows\apppatch\Custom\backup.exe

C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\

C:\Windows\apppatch\Custom\Custom64\backup.exe

C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\

C:\Windows\apppatch\CustomSDB\backup.exe

C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\

C:\Windows\apppatch\de-DE\backup.exe

C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\data.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\

C:\Windows\apppatch\en-US\backup.exe

C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\

C:\Windows\apppatch\es-ES\backup.exe

C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\

C:\Windows\apppatch\fr-FR\backup.exe

C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\

C:\Windows\apppatch\it-IT\backup.exe

C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\

C:\Windows\apppatch\ja-JP\backup.exe

C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\

C:\Windows\AppReadiness\backup.exe

C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\

C:\Program Files\Microsoft Office 15\backup.exe

"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\

C:\Program Files\Microsoft Office 15\ClientX64\System Restore.exe

"C:\Program Files\Microsoft Office 15\ClientX64\System Restore.exe" C:\Program Files\Microsoft Office 15\ClientX64\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\System Restore.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\

C:\Windows\assembly\backup.exe

C:\Windows\assembly\backup.exe C:\Windows\assembly\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\

C:\Program Files\Microsoft Office\Updates\backup.exe

"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\

C:\Windows\assembly\GAC\backup.exe

C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\

C:\Program Files\Mozilla Firefox\backup.exe

"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\

C:\Program Files\Microsoft Office\Updates\Apply\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\

C:\Program Files\Mozilla Firefox\browser\backup.exe

"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\

C:\Windows\assembly\GAC\ADODB\backup.exe

C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Mozilla Firefox\browser\features\backup.exe

"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\

C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\backup.exe

"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\

C:\Windows\assembly\GAC\Extensibility\backup.exe

C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\

C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe

"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\

C:\Program Files\Microsoft Office\Updates\Download\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\

C:\Program Files\Mozilla Firefox\defaults\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\update.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\update.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe

"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\

C:\Program Files\Microsoft Office\root\rsod\backup.exe

"C:\Program Files\Microsoft Office\root\rsod\backup.exe" C:\Program Files\Microsoft Office\root\rsod\

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\update.exe

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\

C:\Program Files\Mozilla Firefox\fonts\backup.exe

"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\

C:\Program Files\Microsoft Office\root\Templates\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\

C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe

"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\

C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\

C:\Program Files\Mozilla Firefox\uninstall\backup.exe

"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\

C:\Windows\assembly\GAC\mscomctl\data.exe

C:\Windows\assembly\GAC\mscomctl\data.exe C:\Windows\assembly\GAC\mscomctl\

C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\

C:\Program Files\MSBuild\backup.exe

"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\

C:\Program Files\MSBuild\Microsoft\backup.exe

"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe

"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B53A34F1-FF5D-4EF4-BFFA-089E897035BB\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\

C:\Windows\assembly\GAC\MSDATASRC\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\

C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe

"C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\

C:\Windows\assembly\GAC\stdole\backup.exe

C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\

C:\Program Files\Microsoft Office\root\vfs\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\backup.exe" C:\Program Files\Microsoft Office\root\vfs\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\

C:\Program Files\Reference Assemblies\backup.exe

"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\

C:\Windows\assembly\GAC_32\backup.exe

C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\

C:\Program Files\Reference Assemblies\Microsoft\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\System Restore.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\

C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\

C:\Program Files (x86)\Google\backup.exe

"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\

C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\

C:\Program Files (x86)\Google\CrashReports\backup.exe

"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\

C:\Windows\assembly\GAC_32\Microsoft.Ink\System Restore.exe

"C:\Windows\assembly\GAC_32\Microsoft.Ink\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.Ink\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System Restore.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\

C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\private\

C:\Program Files (x86)\Common Files\Oracle\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\

C:\Program Files (x86)\Google\Temp\backup.exe

"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\update.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\

C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\

C:\Program Files (x86)\Google\Update\backup.exe

"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe

"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Common Files\Services\backup.exe

"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\

C:\Program Files (x86)\Google\Update\Download\backup.exe

"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files (x86)\Common Files\System\backup.exe

"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\System Restore.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\

C:\Program Files (x86)\Common Files\System\ado\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\backup.exe

"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\

C:\Windows\assembly\GAC_32\MSBuild\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\

C:\Program Files (x86)\Google\Update\Install\System Restore.exe

"C:\Program Files (x86)\Google\Update\Install\System Restore.exe" C:\Program Files (x86)\Google\Update\Install\

C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\

C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\backup.exe

"C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\

C:\Windows\assembly\GAC_32\mscorlib\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\data.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\data.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\

C:\Program Files (x86)\Google\Update\Offline\backup.exe

"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe

"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\

C:\Program Files (x86)\Internet Explorer\backup.exe

"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\data.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\

C:\Program Files\VideoLAN\backup.exe

"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\

C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe

"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\data.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\

C:\Windows\assembly\GAC_32\srmlib\backup.exe

C:\Windows\assembly\GAC_32\srmlib\backup.exe C:\Windows\assembly\GAC_32\srmlib\

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\

C:\Program Files\VideoLAN\VLC\backup.exe

"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\

C:\Program Files (x86)\Internet Explorer\en-US\backup.exe

"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe

"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\

C:\Program Files (x86)\Common Files\System\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\

C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe

"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\

C:\Program Files\VideoLAN\VLC\locale\System Restore.exe

"C:\Program Files\VideoLAN\VLC\locale\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\System Restore.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\

C:\Program Files (x86)\Common Files\System\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\

C:\Windows\assembly\GAC_32\System.Data\update.exe

C:\Windows\assembly\GAC_32\System.Data\update.exe C:\Windows\assembly\GAC_32\System.Data\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\

C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe

"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Common Files\System\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\

C:\Program Files (x86)\Internet Explorer\images\backup.exe

"C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\

C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe

C:\Windows\assembly\GAC_32\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\

C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe

"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\

C:\Program Files (x86)\Common Files\System\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\

C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe

"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\af\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\

C:\Program Files\Microsoft Office\root\Office16\OneNote\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\OneNote\backup.exe" C:\Program Files\Microsoft Office\root\Office16\OneNote\

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\

C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\

C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe

"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\

C:\Program Files (x86)\Common Files\System\msadc\System Restore.exe

"C:\Program Files (x86)\Common Files\System\msadc\System Restore.exe" C:\Program Files (x86)\Common Files\System\msadc\

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\

C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\osfFPA\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\

C:\Program Files (x86)\Internet Explorer\uk-UA\update.exe

"C:\Program Files (x86)\Internet Explorer\uk-UA\update.exe" C:\Program Files (x86)\Internet Explorer\uk-UA\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\

C:\Program Files\VideoLAN\VLC\locale\am\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\backup.exe" C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\

C:\Program Files (x86)\Microsoft\backup.exe

"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\

C:\Windows\assembly\GAC_32\System.Printing\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\backup.exe C:\Windows\assembly\GAC_32\System.Printing\

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\

C:\Program Files (x86)\Microsoft\Edge\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\data.exe

"C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\data.exe" C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\

C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\

C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\

C:\Program Files\Microsoft Office\root\Office16\PROOF\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\PROOF\backup.exe" C:\Program Files\Microsoft Office\root\Office16\PROOF\

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\

C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\update.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\

C:\Program Files\Microsoft Office\root\Office16\QUERIES\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\QUERIES\backup.exe" C:\Program Files\Microsoft Office\root\Office16\QUERIES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\

C:\Program Files\VideoLAN\VLC\locale\an\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\

C:\Windows\assembly\GAC_32\System.Web\backup.exe

C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\Office16\SAMPLES\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\SAMPLES\backup.exe" C:\Program Files\Microsoft Office\root\Office16\SAMPLES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\

C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\

C:\Windows\assembly\GAC_64\backup.exe

C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\

C:\Program Files\Microsoft Office\root\Office16\sdxs\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\

C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\

C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe

C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\

C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe

"C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe

"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\

C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe

"C:\Program Files (x86)\Common Files\System\uk-UA\backup.exe" C:\Program Files (x86)\Common Files\System\uk-UA\

C:\Program Files\VideoLAN\VLC\locale\be\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\

C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\

C:\Windows\bcastdvr\backup.exe

C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\

C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\System Restore.exe

"C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\System Restore.exe" C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\

C:\Windows\Branding\update.exe

C:\Windows\Branding\update.exe C:\Windows\Branding\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\

C:\Windows\Branding\Basebrd\backup.exe

C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\update.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\update.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\

C:\Windows\assembly\GAC_64\MSBuild\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\backup.exe C:\Windows\assembly\GAC_64\MSBuild\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\

C:\Windows\Branding\Basebrd\de-DE\backup.exe

C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\data.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\

C:\Windows\Branding\Basebrd\en-US\backup.exe

C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\

C:\Windows\Branding\Basebrd\es-ES\backup.exe

C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\

C:\Program Files\VideoLAN\VLC\locale\br\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\data.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\

C:\Windows\assembly\GAC_64\mscorlib\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe

C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\

C:\Windows\Branding\Basebrd\fr-FR\backup.exe

C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\

C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe

C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\

C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\backup.exe

"C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\backup.exe" C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\

C:\Windows\Branding\Basebrd\it-IT\backup.exe

C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\backup.exe

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe

"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\

Network

Files

C:\Users\Admin\AppData\Local\Temp\{57063795-DD8F-498D-8374-11BAA1CD0955}\backup.exe

MD5 6d0703cca6495575d49d1f0b0b104be5
SHA1 c41c4d64e538c9ef85ec781827e72078e3a28353
SHA256 e866e485d0108fd387f03e6306eedc31d399daa13f7dcfbe9819484a5974197e
SHA512 493d71966ea276a33341fc3ca9c3ed13880a0a36c869422fe13604890d9f9dc0f1cb195cc3e4481588f7ea795c9f8770c1da2d33f45283b27648c98a24619d5f

C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

MD5 36b383b672a09110eb262f1881e75605
SHA1 9bcc6cd18e7a939f8867c3493396b62c6659ab61
SHA256 5ca5bf4ea6d4413e2c16aa3aa7c7e3772d186350439089045f7da5803f1521de
SHA512 d5640278f799f295b2f1d94e363a3f542326fd2f6032bc80118b26fa3acbef890cc9f3059887b05a39d9691a21977d2f421d0e951d942d6924d553ec7e807f0c

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

MD5 2deec288fd023b6ca100c9ad449dd04d
SHA1 4d2188a0cdb7f71ce5a65269af62a35abfa62a02
SHA256 ab6e21cc9b1f138780eeadf147f6c16f96656af63f3ec67b32e71171ecff6140
SHA512 7c98654f334ff38d0fbaceb6a92fba5de117086fe9589d618c4c46997447f16e7bb5410e10aa6a82ebd79b48ffefe756310af26ef132c5b3d56f062596b6615a

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

MD5 505cd4f73a6d1021631fb1f564f4d81c
SHA1 f1299ffa5e554acd5f52708e2a50ed8142383b14
SHA256 414e6fb4792d03c2a9d76e45a1b196f51dcdba0ecdf7ae64fd74e85f24521849
SHA512 febfbf532ba2d402605a5cefd3b7172033e8518cdcff293b2b03babfc8734c9457c13cf0e8845b06357cdd0d8932180034ee375cbd69fc3187d8f17294d09877

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\backup.exe

MD5 1a8ead92d5ed85b34310922aa15264ff
SHA1 15263391213ca561218ba74854039d21ffbd7c9f
SHA256 adfcf432dc91e117088773e471051ea8cf633f203491764e098608d5e52595d4
SHA512 83fb23ebe33846700e607b24d039e1e8b097a9d4481f2624a6d5c15f9f44108696093ce6b44a096d8313a66196c8017708a70fc57891bb322d37a26ebd49a0c3

C:\Users\Admin\AppData\Local\Temp\temp.zip

MD5 c8de847d89a33b2153295aaa2656a698
SHA1 adc415fef927786df6695b59a96fd92a8d5811a4
SHA256 2980a658567a1f771ae3ef934298e4a02d58c6cf9fe65bda9fe640c74c50c609
SHA512 23d280b8d37231dc2e4f567bf31d50a33ca8b0b024e39b714953a852c323924a5ce6b5a3e9f924b3343771a791aa5b23e3294dedaf18a4f29fe898b1ff26e2a7

C:\PerfLogs\update.exe

MD5 f14a26be01474f434e485bcfc937e73f
SHA1 8acc388cd6d1be68b36b707bdde010b1d5defbc9
SHA256 0c3616e88858938a57f18284163880a9877c0ec85624b9356f0a5082f088b6a6
SHA512 6a0d7f88e66e88bdada30082debd93c51b50838202d1591093fed43da543102680452be69bef95856a54a77906a88569a07a55f7a3cc2e8119c55fe2b4c803a8

C:\Program Files\7-Zip\backup.exe

MD5 fe2151a8019145bf2283154d62fc845a
SHA1 b252c74a6e24436010091a7298e938815900e8a1
SHA256 9d16dc0fcde286b80087008689462c3d7146301bfb9413f9e36501eb5f3c3f60
SHA512 f6f4444844e90f0acc5cf5e04c7dbb78d5444dd7e33b4c554f6bc57daf3162bee04e51413b7defe974fe65cc264f3fafcb6803a3a245b92d4c66ee3d103a592d

C:\Program Files\7-Zip\Lang\backup.exe

MD5 fdd724774121cdde25ff5655401b278d
SHA1 1dde32e2fd0c4b1f691fc7417adaf0c772ee9ddd
SHA256 d89a6f860fb97992712e28958f5d692412f443f8272587dba5c723ed3343b758
SHA512 38d24795b1a65b92dbfc75ae26b63a4c777b29ad3f50f593c3e4be78c9f3daafd659bed53c51d2329a5a6861428a004799aeeda621f8d63eba6a3a71b55c23c5

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

MD5 d5fe871ab986a57ed38ae7dd39703745
SHA1 e76ae323cfb933703d0f0f367c6acee2ec26373b
SHA256 1a190cbf9d5dd01819e56a4266d75990ff161a06e21c64a1463fe1671c08cc41
SHA512 fc528457dcdc64d04648f42bb270f3384672988bb42d0b89192764a87764806d8f1489fb93354e50947180a8469aad0b1ef98dbdb5b7bd7eacfff9a4e5aa8d82

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

MD5 166671199061649f76797259ea1fab3e
SHA1 17583778a0604691d72aa8dbcdcfb6646efacb78
SHA256 5f357c63ce93431e0d02e839fa067000f1506a7a6b54e8cc32565f4733cf338f
SHA512 a59248806064af47e128f037caaffe189e92995887a206fdc94feff8623c19d73749f595badc3b3dcea1c8c0bd06271b10e9b5e847aa060680279f349f4d9290