CmdID

CmdID / Files

zCrashReport64.exe

Crash Report Delivery Module file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real zCrashReport64.exe?

file version info and known copies
Original nameCrashSender.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\aomhost\
Signed byZoom Video Communications
ProductCrashRpt
DescriptionCrash Report Delivery Module

4 known copies

5.8.3.1581 · C:\Program Files (x86)\Zoom\bin\aomhost\zCrashReport64.exe · signed by Zoom Video Communications

06c58e85e3ad5d8d4a07d97fcef0a522edc61db3ab05bec734e2c19cdd206170

5.3.52670.0921 · C:\Program Files (x86)\Zoom\bin\aomhost\zCrashReport64.exe · signed by Zoom Video Communications

cfce140c2163d294ab03e356b9d9c8538bbb57bb96f9b23e579177eeb6ebc82a

5.2.44052.0816 · C:\program files (x86)\Zoom\bin\aomhost\zCrashReport64.exe · signed by Zoom Video Communications

174f0f2e68dafd7b4a4bcadc32e53c42d2860dc77e21ea5926cc810e322bcc42

5.2.42619.0804 · C:\Program Files (x86)\Zoom\bin\aomhost\zCrashReport64.exe · signed by Zoom Video Communications

f13666bbc55d66c271c3958f09b3d1620caf4ce1ea70dfc7670c5beb57545bd1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.