CmdID

CmdID / Files

ARP.EXE

TCP/IP Arp Command file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ARP.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Arp Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ARP.EXE · signed by Microsoft Windows

65825004adac397ee13de0bff884b499370fb5037794f46624f989fba3a89229

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ARP.EXE · signed by Microsoft Windows

c9d31c0ad9959134c37139a106ef90d2ff492214fc583cff6f4239ca8d80cd19

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ARP.EXE · signed by Microsoft Windows

7b79171410482f410b7572c58edb7fd39326f7150c7c6882249b1cf9d7c970f0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ARP.EXE · signed by Microsoft Windows

f9c384659e3c66fb0af5f18d19a16ae11910aefd3beafe2170f937fd521e0391

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ARP.EXE · signed by Microsoft Windows

0eddb0e2a49b30e99f5f435bdff0928263350729020df02892ceafba368255bb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ARP.EXE · signed by Microsoft Windows

28aba00ae4f5f93b6b60ffcd9037167880eff26ff8116086342a22841d69fd6b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ARP.EXE · signed by Microsoft Windows

6f928475e24f329dfd465d7b2411573b9824c317c704708e077f4732e58d0153

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ARP.EXE · signed by Microsoft Windows

f0b2969246808aaa41dc74fe8138a542560564474dfba79da329b44a951cc574

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ARP.EXE · signed by Microsoft Windows

c1a71bbb60fab4b6af35e9accf65d965738db35e9cfd99bc5f9ae9728dc7cdc8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ARP.EXE · signed by Microsoft Windows

cca1f962f9435330c556f07a1745d743ad7acad7561c4c79420b0bf16c8e1d0a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ARP.EXE · not signed

11442daf24bb902c254a4ef59b6cce2326290334196dad46056c4061ebeb6614

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ARP.EXE · not signed

5e04f971aec03d76f981e1a085f18792b751397260e3dc10266c5f200d89a791

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ARP.EXE
highPotential Process Injection Via Msra.EXEAlexander McDonald
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
mediumObfuscated IP Via CLINasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)