api-ms-win-crt-environment-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-environment-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows

29656b4f4f985952c5edee8e66ad7901e47c3c5619965dddc9939c5ce5ab7d58

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows

4c246a9b3c55b0ca1ee1f53a70034c8d0a073876b8b938bcea3e294505414714

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows

5833bf2d9a301ed80514e6133b0dff7c9ba152b4631fa6bc0153fdd696c0757f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

5cfa33e40c07bbd6892a5fcba066a2bce99b3d6dc528608b576bafb6f83563b6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows

7bd17163aa56783867b42a267a3805b342df6d7e832e6ae8f0045d80d73543c6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Windows

e4c803574676b5517d264a66d9aaa1f87feda1c985f4ea35ffea6b753abdcc56

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Corporation

fb1eb3c0fb366b81632c99674e06db9dd848eda2bef11aa96186e1c8706feb9c

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Corporation

2baffc5af143f97879c868959b78c0991964236a082e562aa774cefbd828e092

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Corporation

2b0fea07db507b7266346eab3ca7ede3821876aadc519daf059b130b85640918

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll · signed by Microsoft Corporation

c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.