api-ms-win-core-file-l2-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-core-file-l2-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\API-MS-Win-core-file-l2-1-0.dll · signed by Microsoft Windows

30399597b801d89cb7da031ee82bf06685f2865a2aee89356b71a387a484cba4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Windows

56bc7d3dd48d9cb209195f71be67d0a90ca929a8d4e6ae5a481f3ab0345da294

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Windows Kits Publisher

716e2f410b3552283b072af6dc65230324c98cb18cc27f863eb192883a8a7804

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Windows

9c8f443b3a42e9e1aaa110b12c85f99b3d42ce22849cc3072cf56e29ccdd8401

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Windows

ce6b41db80cc6e437faac2b17852f26895ece6fa5ca1e31ded5339db4d1ae0a6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\API-MS-Win-core-file-l2-1-0.dll · signed by Microsoft Windows

f8f32a9a8d8d2c367d32253d50f02144f56a3374110cb22c82a6223cdb0de266

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Corporation

52ae0d62c8cdd805f879c6c5b1623b72db79b2aeaa5371e701e0507efc58595c

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Corporation

a11c772b2451b0c9c706b03381819e4a1def3e2fbbba8362509bbe57dbd5c666

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Corporation

355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll · signed by Microsoft Corporation

6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.