Windows Firewall with Advanced Security question

Call it paranoia - I set up the firewall to block all outbound traffic by default, and to allow traffic only if it meets a rule.

I experimented with ping and tracert from the command prompt.

Normally, they both don't work. When I create a rule to allow outbound ICMP traffic, they do work. That's what I expect.

Now I change the rule. Instead of allowing ICMP for any program, I change the program to C:\Windows\System32\PING.EXE , and I leave the ICMP part as it was. I expect that ping still works, but tracert doesn't.

However, neither ping nor tracert works. WHY? To state my question differently: is there a way to allow outbound ICMP for ping, but to disallow it for tracert (or the other way round)?