CmdID

CmdID / Files

ROUTE.EXE

TCP/IP Route Command file version info

Program on Windows 12 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ROUTE.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Route Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ROUTE.EXE · signed by Microsoft Windows

09143b295c43ef23e65b5011a5a1502eb513eb5bc6dacdc4fdd9afd4b42199a4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ROUTE.EXE · signed by Microsoft Windows

275a00309694de084973a3efd332fa4e4a77892e17dd4fe71639fd50e14f2a11

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ROUTE.EXE · signed by Microsoft Windows

3eeb168f75126e2dc62746e5231399e9b0f71e8b910195931189ddfc5edf88c6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ROUTE.EXE · signed by Microsoft Windows

b8a28aeb6345ca88b04ff3d9fadf30eacf26958c991bd8e4fb1df12a68f60eae

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ROUTE.EXE · signed by Microsoft Windows

24970ca288e3c7a2cba348461def8912e90a5ca7fb11e7e16205111c8c0db869

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ROUTE.EXE · signed by Microsoft Windows

9e9c7696859b94b1c33a532fa4d5c648226cf3361121dd899e502b8949fb11a6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ROUTE.EXE · signed by Microsoft Windows

3ee231b69bccacfbf961d2a8c624f4b4236ec54a239490b080d31d82b03f7c2d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ROUTE.EXE · signed by Microsoft Windows

ccdcc49b612bd8c3c5075bf760b2e49dda20a23a16e156ec3955dd349bcb5805

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ROUTE.EXE · signed by Microsoft Windows

3bc0a2c1f62bdcc9d697685ef2ed70d083234995dfaeebfb974ff1f1eb5d0c9a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ROUTE.EXE · signed by Microsoft Windows

bfe7a626bf3b9080997401969954ae0376476fd220e80cc52707ff31ce827d53

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ROUTE.EXE · not signed

e51e2710a2ab52bcbb29717b4a6c4c58778f0aeaf58bdab9dfab791ff767e956

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ROUTE.EXE · not signed

faa82727dd1a6fbc990a724e609b3f864b27f103088e89239d609cc208835ab2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ROUTE.EXE
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems)
highPotential Process Injection Via Msra.EXEAlexander McDonald

Sigma names ROUTE.EXE in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.