CmdID

CmdID / Files

api-ms-win-crt-conio-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 9 known copies with hashes

Is it the real api-ms-win-crt-conio-l1-1-0.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Microsoft Office\root\Client\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

9 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows

22c729fb45b274cde72fbe83078d28d76e94d61914e0087cebb73cefb8e590bd

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

24071f0a5fa5e022204eb6924fa7cecfd578a91f345886615bc77f970018950d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows

25bbdabc7b8d8edf5cd05b5591edca13236724cad1011393e010df3c58fd6f7e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows

b009ad33c5ecc934791565e8b38c55b4712f79d53a257a04295561d12b4a122a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows

b1d8cde490382992d4c73a75c532999bd25fcf4dc484e99c4df0da3bb8eab064

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Windows

d8e1fa3ca3be1cedfea33515cd80cf951d5a2fdbe1d1cc5fe62eb8964fc74f00

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Corporation

bb116a317977ec748cfc5ca1bdeef6db06974e338d1cb6ea4cccb304f6ede809

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Corporation

3067981026fad83882f211bfe32210ce17f89c6a15916c13e62069e00d5a19e3

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll · signed by Microsoft Corporation

c17786e9031062f56e4b205f394a795e11ef9367b922763ddf391f2acab2e979

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.