api-ms-win-core-localization-l1-2-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-core-localization-l1-2-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows Kits Publisher

3de886ec334d1115877801d9d1393a8404d80bd548748eba923da00122cd511d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows

8a4b5a175d575d1037a046156630df4ca5389b4919a9746e1a2f5d456ca50bd8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows

8e022faf3a8f7df42fb5c955b78a1416c455b819b4708cfc3bd619c914c1d5a7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows

a36792281c0aaab929635bb1f40ee3627225e7e35e6a199c188f3f782c7e6c27

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows

bf05002e9a83b94196ae0f1b1f53e8ba1356801b02bb7181b27edb5437988ded

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Windows

bf85a20c2392e5a000c98b079ebae06aaa0b577f435ee4eb51e2818ca1cd7d31

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Corporation

4f11443a2fa6c714d3e33597f0d08de4e11a6a2fdb7de2e4a01addd5977665c5

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Corporation

681bf503dbd6c07d59f73f2434ed688184c9f4e5bb33530a4bf709e60fdd24d8

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Corporation

a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll · signed by Microsoft Corporation

b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.