CmdID

CmdID / Files

MicrosoftEdgeSH.exe

Microsoft Edge Web Platform file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MicrosoftEdgeSH.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Edge Web Platform, Microsoft Corporation
DescriptionMicrosoft Edge Web Platform

4 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MicrosoftEdgeSH.exe · signed by Microsoft Windows

bc6ef07260624e303aac107d388d87ce85fd0d545efbe57da5f59433c2bacae3

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MicrosoftEdgeSH.exe · signed by Microsoft Windows

e5d93718f0905b341d6fc68399257d88c56479b2a7ffb253fd88a405e6ed6e74

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MicrosoftEdgeSH.exe · signed by Microsoft Windows

9e8a6c23cd45651027a74e154eb52901409b1f2916c02176accdbc722a26dd36

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\MicrosoftEdgeSH.exe · signed by Microsoft Windows

d7a4f824b02c13daaca06815f1d579612b24d6b0fc4138317fc23d2aa7e24025

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name MicrosoftEdgeSH.exe
highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar