Rocky Raccoon

ShadowPro.exe

by StorageCraft/Arcserve
Backup

Summary

ShadowProtect / StorageCraft backup agent - image-based backup solution for disaster recovery.

ShadowPro.exe is the 417th most commonly executed Windows program in EchoTrail's dataset, observed 17,332 times across enterprise environments. It typically runs from C:\Program Files (x86)\SAAZOD and it is most often launched by SAAZScheduler.exe.

417th
most commonly executed Windows program
17,332
observed executions
medium
statistical confidence

Behavior

Top Paths

  • C:\Program Files (x86)\SAAZOD100%

Top Hashes (SHA256)

  • 6185c5060ef2a391726d8161d18b26095d2a737a8f60de4cfa68fba6c996dba239.37%
  • cb4a736e5c37a71dd24ed30e96462784159b858bf299c53bf3dd31a89b77309a38.71%
  • c6f13ac9506d69c64277657abd398e47a3bbd918e25af2fe071992feadc0215a19.74%
  • b74cefea6636180086359e0f9be22b2500585700490edb9036ac10de04e41d422.18%

Process Ancestry

Top Parents

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about ShadowPro.exe

Rocky answers questions about ShadowPro.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.