CmdID

CmdID / Files

api-ms-win-core-util-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 7 known copies with hashes

Is it the real api-ms-win-core-util-l1-1-0.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

7 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows

514be125e573f7d0e92f36f9dc3a2debb39a8cae840cbd6c7876296e6d4529b7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows

6b38b7cbd1e1c387514f1bc464c0eef74537d059e09a20b3883dad5ba5e19d34

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows

76748b18c61fac93fe1c0587711e3ec0b306b2c92198f0b8b4f6bad8c6d9ba8f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows

997ea6ac7e3a7694bec331b3fa4dd03ac0d7e5f721c87b84b7d2d533140c31b6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

c82a6e07f69e07c868119730c17414b9d455920f1030fe058eacdc196233ee93

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Windows

e7ff028741bdea70f69586c0e9546b272e71de1abfa24a6a50d0cbac422bb81a

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-core-util-l1-1-0.dll · signed by Microsoft Corporation

48d491b08d395a8ac47cc22a70d1c3f5e84d716afe2678e825f24492e8ff2ed4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.