CmdID

CmdID / Files

ucsvc.exe

Boot File Servicing Utility file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ucsvc.exe?

file version info and known copies
Original namebfsvc.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBoot File Servicing Utility

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ucsvc.exe · signed by Microsoft Windows

482b3e17295c2e27b5a38f0a31ce760eaeb12512ea05d68587a38e11d6125796

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ucsvc.exe · signed by Microsoft Windows

2bfac411f014d87171cf09b110ec44436f4a0850b8b2cc3a4f72e7412f7a9d39

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ucsvc.exe · signed by Microsoft Windows

f6c935217111557b329c78119297e117c07d44533d50181e923c72972bf75aec

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ucsvc.exe · signed by Microsoft Windows

b36628817a85b2491cb70b6f1f7283c5c9ccb7efde9ace06ae09a9360bcdbb53

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ucsvc.exe · signed by Microsoft Windows

ebf0e74175ebd17424626b25dd561bdf940ad23f900de973c914713a9812398c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ucsvc.exe · not signed

70b3e9aba2f8da3e00788cace8a7efe7968f93f0225c705e41e58e98a9afb25f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.