» google+ auto backup.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

google+ auto backup.exe

AutoBackup

Google Inc

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Google+ Auto Backup’. This is installed with multiple programs including Google Talk Plugin and Google+ Auto Backup.

File name:

google+ auto backup.exe

Publisher:

Google Inc. (signed by Google Inc)

Product:

AutoBackup

Version:

1.0.21.81

MD5:

e5ea9032823e11543475d46775258cda

SHA-1:

4b7dd87677ab530d7356df0c4b68ddbf8796839c

SHA-256:

6056be7d6feb8d433e61829255d60b09961f6217d9de7c600a421d57d853ce93

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

11/27/2024 4:16:34 AM UTC (today)

File size:

3.5 MB (3,619,096 bytes)

Product version:

1.0.21.81

Original file name:

GPUploader.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\programs\google\google+ auto backup\google+ auto backup.exe

Digital Signature

Signed by:

Google Inc

Authority:

VeriSign, Inc.

Valid from:

11/13/2011 4:00:00 PM

Valid to:

11/13/2014 3:59:59 PM

Subject:

CN=Google Inc, OU=Digital ID Class 3 - Java Object Signing, O=Google Inc, L=Mountain View, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

09E28B26DB593EC4E73286B66499C370

File PE Metadata

Compilation timestamp:

1/6/2014 10:59:23 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

49152:5cx99JKJ7VjpQmbJ089wvGfXP/kEJUVs60DjUKO/pxhT9YTYvPZu5JTidb:5m9uVjpQQ089TUKOBxhTWghug

Entry address:

0x26D846

Entry point:

E8, D6, 9D, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 8B, 45, 14, 56, 57, 33, FF, 3B, C7, 74, 47, 39, 7D, 08, 75, 1B, E8, 2D, 12, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 3E, EC, FF, FF, 83, C4, 14, 8B, C6, EB, 29, 39, 7D, 10, 74, E0, 39, 45, 0C, 73, 0E, E8, 08, 12, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, D7, 50, FF, 75, 10, FF, 75, 08, E8, BE, DD, FF, FF, 83, C4, 0C, 33, C0, 5F, 5E, 5D, C3, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 69, 33, C0, 8A, 44, 24, 08, 84, C0, 75, 16... 
[+]

Entropy:

6.4327

Code size:

2.6 MB (2,727,936 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Google+ Auto Backup

Command:

"C:\users\{user}\appdata\local\programs\google\google+ auto backup\google+ auto backup.exe" \autostart

The file google+ auto backup.exe has been discovered within the following programs.

Google Talk Plugin by Google Inc

Google Talk is an instant messaging service that provides both text and voice communication. Google Talk is also the name of the client applications offered by Google to access the service. Google Talk is integrated into Gmail. Users can send instant messages to other Gmail users.

www.google.com/talk

9% remove it

Google+ Auto Backup by Google Inc

Publisher's description - “When you take a photo or video with your mobile device, you can get it automatically backed up to Google+ without lifting a finger. You'll also get access to cool features like Auto Awesome, Auto Enhance, photo editor, and unlimited standard-size backups.”

support.google.com/plus/?p=gpautobackup

8% remove it

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.