ucrtbase.dll

Microsoft C Runtime Library file version info

Library on Windows 14 known copies with hashes

Is it the real ucrtbase.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft C Runtime Library

14 known copies

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ucrtbase.dll · signed by Microsoft Windows

490238c3a85c4afbc7812f2a36b69155f9fcac7955b2fb7eddfb2cf0feefe40f

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\ucrtbase.dll · signed by Microsoft Windows

769df4fd2116f47020f23abc05200da03908b40eda5cdd84df572ed83f34ff05

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\ucrtbase.dll · signed by Microsoft Windows

3cac979f82a0508b24da2a63d2654b89883cc11062b77b3c2d6fdce7e74c5db7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\ucrtbase.dll · signed by Microsoft Windows

83e7252e6af0e63bd80bc996eed6cb687c36b94f20a55a16145d5e68076b1587

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\ucrtbase.dll · signed by Microsoft Windows

ac3319177333327e4ffbc42bc268aa1873d60ef21541085ed0778c5862c466b9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\ucrtbase.dll · signed by Microsoft Windows

c3c6ff3005623a771cf1642beabb62add5f101782b8f2b60081ab3faf2824cca

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\ucrtbase.dll · signed by Microsoft Windows

d67926328a72816d2944d7c88df6ff4bfccd41a9ce39af0309a0639829d0e7fb

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\ucrtbase.dll · signed by Microsoft Windows Kits Publisher

d9593ed5671bc3291ce65171e1e00a5dc8f1080589b78ef3383e1e48402757b5

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\ucrtbase.dll · signed by Microsoft Corporation

a0b9e4ca04e89c311105d24bb8b9262ea3c00fa2967539eef94ccbdee5b4664c

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\ucrtbase.dll · signed by Microsoft Corporation

f085b1b009ab89049ba95dd4ffde276d5b1f6fa0055f58dc3fc0d4b03ae8116d

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll · signed by Microsoft Corporation

1ca33187b0e81cd0b181a554718cafff2d17c3f6795e6e0824f844abfbaddc07

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ucrtbase.dll · signed by Microsoft Corporation

2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\ucrtbase.dll · signed by Microsoft Corporation

7041885b2a8300bf12a46510228ce8d103d74e83b1baf696b84ff3e5ab785dd1

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Office16\UCRTBASE.DLL · signed by Windows Phone

ef2a371edb8835629de7a839f5b5d61c554c9e307cc4bf05cd9634817c0914f2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.