CmdID

CmdID / Files

NDKPing.exe

RDMA Ping Cmd file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real NDKPing.exe?

file version info and known copies
Original nameRdmaPing.sys in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRDMA Ping Cmd

3 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NDKPing.exe · signed by Microsoft Windows

f92cbfbd8babf5da4f0406c2c7d92af00a6c45806f1ab856611f8f7fb4359379

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\NDKPing.exe · signed by Microsoft Windows

e2e6ea04db42f5abd29c767681798b070a25b0768106689e36613b2e3a810170

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NDKPing.exe · signed by Microsoft Windows

6b5e04c6cc05b0f9b48b6512ffe8990be535b30cabf618a3ccbbeafae7715e8f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.