CmdID

CmdID / Files

api-ms-win-core-rtlsupport-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 7 known copies with hashes

Is it the real api-ms-win-core-rtlsupport-l1-1-0.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

7 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows

024a97c745096191a8df9d581efcbefcfbfd0e73c636773941b251642004577c

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows

5208000a52363b1de665d5d46cd6f4da45f0c19c74876918e165e23efed26e92

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows

8a6b6c7731f6922e6e125feceaca919e4d26a96349c7b0c90e469396b34b29c7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows

dcddf6d1282a5967073aa702a2768ef1ddd7d44cf1f18f0bf5e463dd2892163b

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows

f344fa150e3ecc77387378e017fbb72a5b90cf2c8c451cae90c4eba3f04bfbdd

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

fb9b7fd732e84c1be0a81567be7624a8e22e4bb9e87d1dab5e6728546e841c16

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-rtlsupport-l1-1-0.dll · signed by Microsoft Corporation

6d541b215cfa452e54dc6af9317a7fc24043fa465ef2b561e0f245a4870b2705

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.