bootcfg.exe
BootCfg - Lists or changes the boot settings. file version info
Program on Windows 10 known copies with hashes Command bootcfg
Is it the real bootcfg.exe?
C:\Windows\system32\C:\Windows\SysWOW64\10 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bootcfg.exe · signed by Microsoft Windows
3ae4009d8722649281c1f352cfd65186198fc6ee8fd62b436869789f8d06d34810.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\bootcfg.exe · signed by Microsoft Windows
f45992f7d3602a41cfcbda622c3e5f9f45ab2a4d19059bc746da151abaaab14010.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\bootcfg.exe · signed by Microsoft Windows
1081a7acb71b4b984501beaf35a12db49b320c4411d65c9b73112dbb3d2ab65e10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bootcfg.exe · signed by Microsoft Windows
3715eb1f20f2ca944dfb2f211a4430cb3bd82a65a63606381d19760933f7dcd510.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\bootcfg.exe · signed by Microsoft Windows
a599e319bc738b22ef91aa1a0770b823cf7affe2cefb09e46421f614066c5d5410.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\bootcfg.exe · signed by Microsoft Windows
be45a65c9a57a9b47b2656c057230d0c37c18299761af5dbb24ee5dce2429ec510.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\bootcfg.exe · signed by Microsoft Windows
cf7686c65ee7b2bcda9624d56bc548147a9b1b66ce32a5bb0ac8c0141d84151910.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\bootcfg.exe · signed by Microsoft Windows
d788be82341083fefb8320ccc9f88cdec21f9cd5582125af4fefbc441fd9a7486.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\bootcfg.exe · not signed
33d7b0893ad2a7565ed27a360e233405d3d41186e276264fe29e0577fc17720d6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\bootcfg.exe · not signed
eca71e18ba0112e834afa9ab087a3ef25431d720b3499eb790d069ebfc5138dfFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.