CmdID

CmdID / Files

api-ms-win-core-synch-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 8 known copies with hashes

Is it the real api-ms-win-core-synch-l1-1-0.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

8 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

2175afb98b712404507986bd491ffd9ab1d470ab78f90bfa5b7d5f8fa0353370

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows

42f0bc17a510dfc87477510f070556740c24745c66a6dfcc38ac857e22bacff6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows

4ef4b7559269a0a826617eb824269eb610bbbc668c0de36cd50cbd7da0e4df85

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows

b48b10bfeda8c32e538b03a9db05864866f8a44d04824f63032f2dc33e39fa1b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows

c3fd578926badfa4fad771972c17a5ef92b2ea8c4c5253e94052fbcbebb2617c

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Windows

f64fabce8aed2f16d65d8533afe11ea814e7c01dc7a839f370c7505eacc556ac

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Corporation

9dfe8688d65e6c70427a0200fb98b0998a77c7e619742ee0728aada5684a9b9d

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-synch-l1-1-0.dll · signed by Microsoft Corporation

bff7ea28e198c7dbee45d35fd98ae03696e9e252d46bec9ff7b7823cba1681f1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.