CiscoCollabHost.exe
Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.
Summary
Cisco collaboration tools host process
CiscoCollabHost.exe is the 1924th most commonly executed Windows program in EchoTrail's dataset, observed 344 times across enterprise environments. It typically runs from C:\Users\... and it is most often launched by CiscoCollabHost.exe.
Get this in your tools
The same record for ciscocollabhost.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/ciscocollabhost.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Users\...99.71%
- C:\Program Files\Cisco Spark0.29%
- C:\Users\lab\AppData\Local\Programs\Cisco Spark
Top Hashes (SHA256)
- a13c6cac0c32caa3dccb76aadc363148e43d5ccc9c70e1d8b279902a3435c1c231.4%
- 94cc2364aee149823dfd29a1c0cfbd5a664d2eb6265a9daf5ebbe4dec1dab09425.58%
- 7bd8c8507d38a47d79afaf9939a9c9ec6c394c3ebe18b3543dd58b10728e15aa22.97%
- 1f07c9babcd476c35d72434c5ece50e9c9d6a504a443eb6334bfddd1e59f89ff17.15%
- 6bdd51dfa47d1a960459019a960950d3415f0f276a740017301735b8580197281.45%
- f0000fe2ea14120e672085a7592f60d2eacc3b7ca9da2edde545782fbe28c4b41.45%
- 3dda060556994113f5ef67b7c50cec33d5305c2d4ee6b62fb23edc1b7c081f34
Code Signing
Signers by share of executions
- 100%Cisco Systems, Inc.ValidEmbedded signature · 1 hash
- Chain
- Cisco Systems, Inc.
- DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- DigiCert Trusted Root G4
- Valid
- Feb 13, 2025 to Feb 27, 2028
- Hashes
- 3dda060556994113f5ef67b7c50cec33d5305c2d4ee6b62fb23edc1b7c081f34100% of executions, first seen Sep 25, 2026
Full certificate detail on Team.
Process Ancestry
Top Parents
- CiscoCollabHost.exe59.64%
- explorer.exe39.76%
Top Children
- CiscoCollabHost.exe85.71%
- WebexHost.exe14.29%
Lab record
- Installed from
- winget Cisco.Webex 46.9.0.35800
- Publisher
- Cisco Systems, Inc.
- Persistence
- none
- Network
- none
- Command lines
- 8 patterns (8 launches)
- DLL loads
- 213 patterns (777 loads)
- Registry writes
- 143 patterns (2,698 writes)
- File writes
- 35 patterns (73 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 0 patterns (0 handshakes)
- Named pipes
- 0 patterns (0 events)
- Process access
- 1 pattern (3 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 0 patterns (0 events)
Full record on Team.
Ask Rocky about CiscoCollabHost.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for CiscoCollabHost.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.