CmdID

CmdID / Files

bfsvc.exe

Boot File Servicing Utility file version info

Program on Windows 9 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real bfsvc.exe?

file version info and known copies
Installed inC:\Windows\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBoot File Servicing Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\bfsvc.exe · signed by Microsoft Windows

48030ae86a728453f427952dd7827a34fd2dbd087e52b62b3a09030b3c3ebafd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

03b0693dee8473ed806b8a4e8e872638e1996a7f67fb0ec06a7b1b24c0e63aef

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

1b17747065aa027a0995460a2e5c9c4c2fe255918892af16c3545b925687f5df

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

57a0279e3b6b158404cfbf5070e33b41963e288a7bb230382b1d3f6116299c75

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\bfsvc.exe · signed by Microsoft Windows

3b0c76dc0eab627c2940124edd5696606783b661737f7a89073c0e8ab65af925

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

cf7cecabb289300d3ef6af45d141c0524abca467076c0a98201bad9a5cce1195

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

d271499cc7039391130509e21f8e1ba7a9e8a49fef71528b94a0448224dfc186

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\bfsvc.exe · signed by Microsoft Windows

b0e48c86dc6aa661651cf8d4f99895dab551b7d89ddf5ca2d9aa7c6a7796506a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\bfsvc.exe · not signed

7150b8e2025d685feb0bfc1e1a05ba481106c4259073ebf5fbe5b427084409a0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.