CmdID / Files

msidcrl40.dll

Microsoft Account Dynamic Link Library file version info

Library on Windows 2 known copies with hashes

Is it the real msidcrl40.dll?

file version info and known copies

Original namemsidcrl.dll in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Account Dynamic Link Library

2 known copies

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msidcrl40.dll · signed by Microsoft Windows

SHA-2561c8372a0e877aaca30b77b8d1da623e85da54d367dfa36e914d0595e63d10bcbSHA-172b3406d09ca047e361f0c997896a51d5259733eMD571dddd8c982686c03824856263e4a911

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\msidcrl40.dll · signed by Microsoft Windows

SHA-25680a0dc8a573010740860a19b790c8450c2a40d9d062f3db1d34a17d4f8da8e40SHA-1f71c68a2ffa719e8879f9ddc401b01081a990fbbMD58ce5fc8f9311994205242adfbda0034a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.