CmdID

CmdID / Files

pubs.exe

Microsoft Office component file version info

Program on Windows 1 known copy with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pubs.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\
Signed byMicrosoft Corporation
ProductMicrosoft Office, Microsoft Corporation
DescriptionMicrosoft Office component

1 known copy

16.0.12527.20458 · C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe · signed by Microsoft Corporation

429447e7fe0e7676051ecaef79467b7da26bd33e6f71272296632b33b5a54a74

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.