CmdID

CmdID / Files

keytool.exe

OpenJDK Platform binary file version info

Program on Windows 15 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real keytool.exe?

file version info and known copies
Installed inC:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\
C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\
C:\program files (x86)\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\
Signed byLondon Jamocha Community CIC
ProductOpenJDK Platform 8, AdoptOpenJDK
DescriptionOpenJDK Platform binary

15 known copies

11.0.8 · C:\program files\AdoptOpenJDK\jre-11.0.8.10-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

305daaf96732fc0e9f424a9de248133247afbbeb5b8f3611e9b5829298256716

11.0.8 · C:\program files\AdoptOpenJDK\jdk-11.0.8.10-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

9711181ab1f535379070d7c76671c022f10e72597281b77af2698ed0e9a09de6

11.0.8 · C:\program files\Amazon Corretto\jdk11.0.8_10\bin\keytool.exe · signed by Amazon.com Services LLC

cb1161713e8fb27b1c960b4c74459687fc91af53e4e8d1a1be4dc251983e0c0f

8.0.2650.1 · C:\Program Files\Amazon Corretto\jdk1.8.0_265\bin\keytool.exe · signed by Amazon.com Services LLC

18ea22b32f479b5faed0b082285af81ac8b62a28a8d69c5e97f133f52028f8a6

8.0.2650.1 · C:\Program Files\Amazon Corretto\jdk1.8.0_265\jre\bin\keytool.exe · signed by Amazon.com Services LLC

2a01a89188724ab531e593e431265f8b20ce8ff75465055fcb9978de5a1dd70b

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jdk1.8.0_265\jre\bin\keytool.exe · signed by Amazon.com Services LLC

2a62070abc56682acbef12428081ec2381f78abcaf07f1fc4a575f7b951ccc45

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\keytool.exe · signed by London Jamocha Community CIC

3db0eb1136f237453044315fa9842c459a8bed8c78fde0e577a2fd581023bb5b

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

4195b7bc67b8615cf92d9ab52269c46ba4dcf657db911900bcddab628514355c

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

77e21837b706df6f1d0d61fd909168fecc5e41a34589478a15f0aeafe69ae574

8.0.2650.1 · C:\Program Files\Amazon Corretto\jre8\bin\keytool.exe · signed by Amazon.com Services LLC

8ebe35aff7b018623d55dff2f62b1f1afdafb50169a5940b14047398052dcb29

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jre8\bin\keytool.exe · signed by Amazon.com Services LLC

9184afb51bfc40aebcebd2bb91e849c9bad98960f1e4f9aed0468d89990a9180

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

b5031f79db684dc0457ecad52ddca7b56e2c46440a091eb49b119ef706920063

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\keytool.exe · signed by London Jamocha Community CIC

cf4f9c898abd60b61040930693c7090e72b25f2490c2ceb25f8f28515ac36941

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jdk1.8.0_265\bin\keytool.exe · signed by Amazon.com Services LLC

e14f542d4988aaa017f9ab15bc21aeb084d5ec768db4218ab19637c53adfd13c

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\keytool.exe · signed by London Jamocha Community CIC

f7e7549f8c21f8d611c5813808b70ae0883b6c3a101ad379e911771c0fb85044

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name keytool.exe
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)