CmdID

CmdID / Files

zCrashReport.exe

Crash Report Delivery Module file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real zCrashReport.exe?

file version info and known copies
Original nameCrashSender.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\
Signed byZoom Video Communications
ProductCrashRpt
DescriptionCrash Report Delivery Module

4 known copies

5.8.3.1581 · C:\Program Files (x86)\Zoom\bin\zCrashReport.exe · signed by Zoom Video Communications

c3911a3479e25bd6f062eb29237f19d79c673291a7e72e7ee15013ccc162cc05

5.3.52670.0921 · C:\Program Files (x86)\Zoom\bin\zCrashReport.exe · signed by Zoom Video Communications

cfcc1ed487c4eca068738c0aa38d554dfe6c3df3ac4b9c9b061ea3dd1b96df08

5.2.44052.0816 · C:\program files (x86)\Zoom\bin\zCrashReport.exe · signed by Zoom Video Communications

e517d01cc1fe185e4b008b693a0928be4f92e48321a82c76c5c4cc2250b9b65c

5.2.42619.0804 · C:\Program Files (x86)\Zoom\bin\zCrashReport.exe · signed by Zoom Video Communications

f5d0f5d86fd4198be76b1b0a5c8802762521f7ce0cf60329b103b8432a96693c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.