CmdID

CmdID / Files

MicrosoftEdgeUpdate.exe

Microsoft Edge Update file version info

Program on Windows 2 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MicrosoftEdgeUpdate.exe?

file version info and known copies
Original namemsedgeupdate.dll in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Microsoft\EdgeUpdate\
Signed byMicrosoft Corporation
ProductMicrosoft Edge Update, Microsoft Corporation
DescriptionMicrosoft Edge Update

2 known copies

1.3.153.47 · C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe · signed by Microsoft Corporation

6737d628504e1ad1b117600383d137bd975f51d0cdf351f6fdb9c714edb45d14

1.3.135.29 · C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe · signed by Microsoft Corporation

a0628836960198f937f134e8a9c12a5ea38d682da3dd5e026170dfbc3eaa992e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names MicrosoftEdgeUpdate.exe in 3 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.