CmdID

CmdID / Files

Zoom.exe

Zoom Meetings file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Zoom.exe?

file version info and known copies
Original nameZoom in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\
Signed byZoom Video Communications
ProductZoom, Zoom Video Communications, Inc.
DescriptionZoom Meetings

4 known copies

5,8,3,1581 · C:\Program Files (x86)\Zoom\bin\Zoom.exe · signed by Zoom Video Communications

c62fc8f76eb083b7dbef840db49dbe8e6387363a194f42d59d6e220b052184ec

5,3,52670,0921 · C:\Program Files (x86)\Zoom\bin\Zoom.exe · signed by Zoom Video Communications

60d256603d7a099062443e6403b78ba98430a5f44817588e7daa1f166b618d60

5,2,44052,0816 · C:\program files (x86)\Zoom\bin\Zoom.exe · signed by Zoom Video Communications

00e8008a3b4bfe3d7d0c58eb8f8be0f8a635d44179410c8459fb9cbdffbcbc80

5,2,42619,0804 · C:\Program Files (x86)\Zoom\bin\Zoom.exe · signed by Zoom Video Communications

fece3e484331280ff99f38b3a15790d428e829e3207ae4f207eb098354d0e55b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names Zoom.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.