GROOVE.EXE
Summary
Microsoft OneDrive for Business (formerly SharePoint Workspace/Groove) - syncs SharePoint document libraries.
GROOVE.EXE is the 905th most commonly executed Windows program in EchoTrail's dataset, observed 2,737 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Office\root\Office16 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Office\root\Office1694.41%
- C:\Program Files\Microsoft Office\root\Office162.81%
- C:\Program Files\Microsoft Office\Office162.23%
- C:\Program Files\Microsoft Office\Office150.47%
- C:\...0.07%
Top Hashes (SHA256)
- 3587244b10899e11d86c6e61dbcbb53da5acacadea13b85ab966c202cbfac84924.73%
- 5f5867ab5d349d1e72cc16b13698c1fcbdc39082d420d8140d10f3a932d3254814.45%
- 73e5dd87b549b8c62fa1656a83957f5c9edca285732b279c2131e36a9571a48d7.13%
- c67c4efaa9b015f2cf7303f5407426b6629fa46a457ee7eb0816059f9d5df7876%
- 595b7f84c0f68e88663d16eccef6ccea484bb59f31c009743e70ff1b7cd5f67b5.22%
- 858156fb7845eba99ea8b1117f1b8f2fb32741634a35d1af5673ac6e9f45dc723.62%
- f953f0dd8e0bd030e484faa793a248624955a66b536898fabce7127ddfc6a8022.41%
- 876f94395f705f4633e8a6fe663d01dd2cc23216a6d0f9a87ca5425fd4f824122.3%
- c0712a4e7ff5b5eaf44b94f359068380226a8981cefdf3b211c948b23485d39e2.18%
- b76098f89e37d257ebcd64b289db25ab16b7efd8cbfdf05561b6ec6755fa94631.99%
Process Ancestry
Top Grandparents
- services.exe47.4%
- userinit.exe44.18%
- explorer.exe5.19%
- OfficeC2RClient.exe0.62%
- OUTLOOK.EXE0.62%
- lync.exe0.19%
- svchost.exe0.15%
- winlogon.exe0.08%
- cmd.exe0.04%
Top Parents
- svchost.exe47.53%
- explorer.exe44.36%
- OUTLOOK.EXE2.19%
- OfficeClickToRun.exe1.75%
- OfficeC2RClient.exe1.35%
- chrome.exe0.62%
- iexplore.exe0.58%
- EXCEL.EXE0.55%
- WerFault.exe0.51%
- DWWIN.EXE0.4%
Top Children
- MSOSYNC.EXE99.5%
- OfficeC2RClient.exe0.32%
- WerFault.exe0.06%
- OneDrive.exe0.02%
- WINWORD.EXE0.01%
- conhost.exe<0.01%
- firefox.exe<0.01%
- GROOVE.EXE<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about GROOVE.EXE
Rocky answers questions about GROOVE.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.