CmdID

CmdID / Files

zUpdater.exe

Zoom Meetings file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real zUpdater.exe?

file version info and known copies
Original nameZoom in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\
Signed byZoom Video Communications
ProductZoom, Zoom Video Communications, Inc.
DescriptionZoom Meetings

4 known copies

5,8,3,1581 · C:\Program Files (x86)\Zoom\bin\zUpdater.exe · signed by Zoom Video Communications

385bfb5aa561fc7e61b23bc12937b0fad6e0f0f2e11e046b21bef9090b2df17a

5,3,52670,0921 · C:\Program Files (x86)\Zoom\bin\zUpdater.exe · signed by Zoom Video Communications

4245f81b4c9a5fdd19c4e3a7c6ec631012d05d12f0e90b3ca175ba42d446f174

5,2,44052,0816 · C:\program files (x86)\Zoom\bin\zUpdater.exe · signed by Zoom Video Communications

2e6f231da26752bade2ab78fb49a3c0172e82a35c977bcc3a00a9d534dba8d42

5,2,42619,0804 · C:\Program Files (x86)\Zoom\bin\zUpdater.exe · signed by Zoom Video Communications

a3eb9eed4ccd3ad665d4f700ef4c7d9be68a0e2d133cbcf8bd7b59448cee0a62

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.