CmdID

CmdID / Files

pospaymentsworker.exe

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pospaymentsworker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows

3 known copies

Version not recorded · C:\Windows\system32\pospaymentsworker.exe · signed by Microsoft Windows

43e3fcb7a777c62d02cb359452c488e114d8da9f9ffa7854ecfb5cd236b9377f

Version not recorded · C:\WINDOWS\system32\pospaymentsworker.exe · signed by Microsoft Windows

7d3933f716fc601f688429ae7949ad24a1da3b8db504591fa60a29ed15ce0e80

Version not recorded · C:\WINDOWS\system32\pospaymentsworker.exe · signed by Microsoft Windows

b9e90c47d3c42a60f9a4e260a4f414341ab22a79f7d7032ae6e4ec5fa98e9ea8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.