zTscoder.exe
Zoom file version info
Program on Windows 4 known copies with hashes
Is it the real zTscoder.exe?
Zoom in the file’s header: a renamed copy still carries itC:\Program Files (x86)\Zoom\bin\4 known copies
5,8,3,1581 · C:\Program Files (x86)\Zoom\bin\zTscoder.exe · signed by Zoom Video Communications
99635dd230a6e4d0d20b989303b3c7efa100912425933c84f0fa8f34be57ea0d5,3,52670,0921 · C:\Program Files (x86)\Zoom\bin\zTscoder.exe · signed by Zoom Video Communications
dd63a15cff2ce34dc513c01e1e75f681cb6ddf8c1ec26074f31ca73098d3ebc25,2,44052,0816 · C:\program files (x86)\Zoom\bin\zTscoder.exe · signed by Zoom Video Communications
048563baa3a9e22250d1802673b116a28bb283eb5fef64178943830575b4808a5,2,42619,0804 · C:\Program Files (x86)\Zoom\bin\zTscoder.exe · signed by Zoom Video Communications
4960a081932c8b0f5c9ebb540cf725ecb101906dc324d9fa96c29e3e5bab236bFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.