api-ms-win-core-file-l1-2-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-core-file-l1-2-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows

1fa836b3704b29e7ad1ea1b0b457f62aae4435c6a1d745707631552a2f83d5f6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows

20fd502d2e56efbd537997cd2304036ac01f33102b166c5e35a5908d616308f8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows

8e096b90b0687a45a56bb85deee36a9bd3624b653901fd5585582e0035a1482a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows

9b7895c39ee69f22a3adc24fe787cba664ad1213cea8bc3184ed937d5121e075

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows

e04ec04a6c3d0dd77918bd671ac0b14a00865cec66ba995a1e369eced65ca89a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Windows Kits Publisher

eee22addfdab96e326c8a03cb0e929e3dd8f6cfbbaaf236b5ea5e124b565f279

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Corporation

35431423fa7a402b8cf17b4845fb17c51b7ab1e8fd7bad5645899f5fddbbdc67

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Corporation

668f91e94e76db4457184909e6a1ab4655e81a8ef37dc37b4ecfe93146c29a88

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Corporation

348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll · signed by Microsoft Corporation

bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.