api-ms-win-core-synch-l1-2-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-core-synch-l1-2-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows

02c4e2dc2c922f17e1e174af76253775ee0ab2f83c421fd769591ce010fb1afd

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows

2e693984cadb0f5076160d800252017e5089928557cde628caa0966d2b3b8f0d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows

36f418f9eeb0c3366bb3f6fbc3f91f37117632c0a5eca697d76792aa5c2165fa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows

781acb1374c15e27b723bc538c4f8eba0a28e6497f4cdf1f323f91d8dc82c121

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows Kits Publisher

a4ddd56452b97e5e4c1d2d3ad1367db299bc2328b5b4ff1a5694f938e57408bf

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Windows

d3e6256c2dd7150cff8ffca9c9cc6ef477c1da72c0d32972d1022381927b8295

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Corporation

028b57b7bc4bd657b2fd82bf27b6436a662b6c67c930241b148b98258a58ba99

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Corporation

e29eaa099be15958cb65d03d47959cae2dac342402856c5f0e4da672193c329d

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Corporation

0c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll · signed by Microsoft Corporation

25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.