CmdID

CmdID / Files

ipconfig.exe

IP Configuration Utility file version info

Program on Windows 12 known copies with hashes 7 Sigma rules name it Command ipconfig

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ipconfig.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionIP Configuration Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ipconfig.exe · signed by Microsoft Windows

6ed413dabf3af2b25f7ff99b5f6dd6576208274189c4ae8260730a6aea1ac28b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ipconfig.exe · signed by Microsoft Windows

eb350a3b01acd5131ced96d91203256caaea8285b59956b6077e245713c8db79

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ipconfig.exe · signed by Microsoft Windows

53e000f5aa9b3a00934319db8080bb99cb323bf48fc628a64f75d7847c265606

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ipconfig.exe · signed by Microsoft Windows

87b036c720fbd5e63355b9920a2864feaf59b1584ebd8458651936ab8c7c1f81

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ipconfig.exe · signed by Microsoft Windows

1803f2b06149d09d568a0d83cab8017925aded03047791dc92d8254de7b2262a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ipconfig.exe · signed by Microsoft Windows

a4370c0cf81686c0b696fa6261c9d3e0d810ae704ab8301839dffd5d5112f476

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ipconfig.exe · signed by Microsoft Windows

b0832dec07a4cb6228b7b392d6abafb79e9bf7327605ae3e86e1e617de7495a5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ipconfig.exe · signed by Microsoft Windows

c5dbbddd1193c7adca1e30cd17b8c7af6a76c406dd84dc164bb959c135f1aa70

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ipconfig.exe · signed by Microsoft Windows

5ee3fd7ca1ac876d0de539d469bfc333594fca3df9f377cc96c756d9648697f1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ipconfig.exe · signed by Microsoft Windows

5f2ff9dfa80dcbae0301500b50f5bb10dda257be9c061b3cfcc9ba3c1fbc8891

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ipconfig.exe · not signed

21e8b9bd30650e96c36e976ae35b01e409199c244e6a5480a746692c01d78b84

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ipconfig.exe · not signed

5440388229f609e47c74734c78beb85d68abd1d79f3cb7a6b6596627d053d0ff

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ipconfig.exe
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems)
highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io)
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

Sigma names ipconfig.exe in 7 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.