Suspicious Executable Created In AOMEI Backupper Tmphtml Directory

Rxn Veera@rxnveera

•updated 3 days ago•3•0•1

Detects a file creation event for any executable inside the "tmphtml" staging directory beneath the AOMEI Backupper installation path, where the creating process is Backupper.exe. The application stages popup resources here before relocating them to html\; a genuine promotional bundle contains no executables, so an .exe written to this path indicates a tampered bundle.