Suspending a riot process..how?

[LaDidi]

Thanks MARKuS to explain better my idea :-)
In fact, RegBackup launch the service RegManServ which launch another instance of RegBackup in a SYSTEM context !
Have you tried to launch via SYSTEM context (ie: AT HH:MM myProg.exe).
You have RegManServ.Log which may help you...
Effectively, it execs :
"C:\app_test\Advanced Registry Doctor\RegBackup.exe" /INIT_DIR="c:\RegBackup\" /local_system

***** A part of the answer *****
As it Executes GlobalAddAtomA("RegManServRegBackup.exe") [see HW_BP in 00411986 or BP on ntdll.ZwAddAtom], it uses DDE !...