CmdID

CmdID / Files

mphost.exe

Zoom file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mphost.exe?

file version info and known copies
Original nameZoom in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\aomhost\
Signed byZoom Video Communications
ProductZoom, Zoom Video Communications, Inc.
DescriptionZoom

3 known copies

5,3,52670,0921 · C:\Program Files (x86)\Zoom\bin\aomhost\mphost.exe · signed by Zoom Video Communications

d1346ce3f20d8da74a82e4eaf4594095f6ada0ae37b183f7fd07ce7c56441d9f

5,2,44052,0816 · C:\program files (x86)\Zoom\bin\aomhost\mphost.exe · signed by Zoom Video Communications

9c56de0ecf2b24e29e963ea1c7fcd48b04378b50808125dadda301dffa83ed77

5,2,42619,0804 · C:\Program Files (x86)\Zoom\bin\aomhost\mphost.exe · signed by Zoom Video Communications

58482ba38c384ad95648a588008b3de1970de5004a61ede7793f13c9a1b35c88

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.