CmdID

CmdID / Files

api-ms-win-core-processthreads-l1-1-1.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-core-processthreads-l1-1-1.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows

30a25b56d4778e94f5fa2ac25facfab779dc0ead6d9c2f19e20244b6604c153b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows

59f5310f1a43676a7e0427692b8276b52c54c9d430a305638e0bd890c97b27cb

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows

a1b79943cdf8ded063cdaec144f8a170de8bbe97b696445885709573c5e0faeb

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows Kits Publisher

d2bd9d513920fefb27bbec1cdd157f5bc3f6a256bbdf7a003ce4a42a1fe35fdd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows

e2e2e55c67c0caf51b06b1fb308accfbc14155decb1cca98af5500fb7fba6296

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Windows

f8b7122ca5e1d473818940fea4d1155af429463038ba61953908fbbbb7a8d613

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Corporation

1ca23dadc3207b068649184b2d5418b653e9e12c9463c626969c33408216b0d6

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Corporation

5bacbbe62e36ad0f6d7742e70361f26bc56a44dbd28cc0291f588420e0c218a6

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Corporation

42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll · signed by Microsoft Corporation

ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.