CmdID

CmdID / Files

PATHPING.EXE

TCP/IP PathPing Command file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command pathping

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PATHPING.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP PathPing Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PATHPING.EXE · signed by Microsoft Windows

3f67d5ef8be09599da597c41dff041615a6bf4e03bd0c47f2175b096f8eb1200

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PATHPING.EXE · signed by Microsoft Windows

9100040c100737451e395762ac7dcd9868de26d57ac8cf540395fbee2b4ea2ce

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PATHPING.EXE · signed by Microsoft Windows

348fb606016a1d9d7a1791a2fd561cf58b2b22165cf3c204ff9c541911078f59

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PATHPING.EXE · signed by Microsoft Windows

bb6753327aecdcc1e9c44e75be44ae94fedddabef038411d510d861a1527e79e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PATHPING.EXE · signed by Microsoft Windows

9bf3289456e40a0f8bc5c4b1920f764bb5a45c19bc92d2b4d348fd64ee367460

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PATHPING.EXE · signed by Microsoft Windows

a1028d6da126819232510226a030491b9d824acf930928f5841ebdd4141b9e34

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PATHPING.EXE · signed by Microsoft Windows

58037e8767caff16722c3dbc1e3b733b9fd269c5a244ce1fa3973e3d31c13fa8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PATHPING.EXE · signed by Microsoft Windows

96a0fa913d1688d61496b0001f5264fc1727c9a7af9232d1eb02811252ed1908

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\PATHPING.EXE · signed by Microsoft Windows

3b2271e94d1479d553477756dbb71b40bbbc1579ad0dafd63e135699ee77f12e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\PATHPING.EXE · signed by Microsoft Windows

42765a6607f2dfaa307c050ed1077327f629aa719db1be49609de28081e45659

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\PATHPING.EXE · not signed

9d07bd65a65cbfef9f9756fb652ddbf4012d981745ca45bae56a6fc44e1b7e0c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\PATHPING.EXE · not signed

b922e594876e9b9c5b0b54487a3453ff26eb18b42013711a10713f21496fcd16

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name PATHPING.EXE
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson