CmdID

CmdID / Files

RemotePosWorker.exe

Remote Pos Driver Worker file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RemotePosWorker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Pos Driver Worker

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RemotePosWorker.exe · signed by Microsoft Windows

39b9ce04b3afd6cc6f0a3dc3f5a1384995bde9ce59fe3ed8e3cc6051c6f1e22e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RemotePosWorker.exe · signed by Microsoft Windows

2868b0cc04e8dc5a415daed0fefec08430261fae6b5707a83a848edf8bf24da7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RemotePosWorker.exe · signed by Microsoft Windows

bf94c96364c18fd3e8daa0551582dbea5a448fa7384089bffed29d883bd50c7a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RemotePosWorker.exe · signed by Microsoft Windows

b1a25d53c302c3b4e7d6affbc309e67c3761e0d189b9fc1389e16c626ef8b09d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RemotePosWorker.exe · signed by Microsoft Windows

a7a6ea6fe8a30462eb41af969bad4a4369072cc325d21b42f5f0b10d3ef75a86

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.