CmdID

CmdID / Files

googledrivesync.exe

Program on Windows 2 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real googledrivesync.exe?

file version info and known copies
Installed inC:\Program Files\Google\Drive\
Signed byGoogle LLC

2 known copies

Version not recorded · C:\Program Files\Google\Drive\googledrivesync.exe · signed by Google LLC

75aa11154b45c24532a9ce7da9fc4575f9c5f6cc913b31791b2a75aa5b6065c1

Version not recorded · C:\Program Files\Google\Drive\googledrivesync.exe · signed by Google LLC

cd244894bc550f53acf372e15742a5b29a7f029f39f1e9927c58b85b9efb4e54

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name googledrivesync.exe
mediumPotential Command Line Path Traversal Evasion AttemptChristian Burkard (Nextron Systems)