CmdID

CmdID / Files

GoogleUpdate.exe

Google Installer file version info

Program on Windows 2 known copies with hashes 9 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real GoogleUpdate.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Google\Update\
Signed byGoogle LLC
ProductGoogle Update, Google LLC
DescriptionGoogle Installer

2 known copies

1.3.36.111 · C:\Program Files (x86)\Google\Update\GoogleUpdate.exe · signed by Google LLC

61a92167587e540275b374890be8fd0319fe03c4f19cc79a8c2fb6871cf21e73

1.3.35.451 · C:\Program Files (x86)\Google\Update\GoogleUpdate.exe · signed by Google LLC

b60e92004d394d0b14a8953a2ba29951c79f2f8a6c94f495e3153dfbbef115b6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name GoogleUpdate.exe
highPotential Goofy Guineapig GoolgeUpdate Process AnomalyX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious GoogleUpdate Child ProcessNasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names GoogleUpdate.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.