api-ms-win-crt-filesystem-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-filesystem-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows

2237fe7b80eae43679e2a770291a9a34f6811c320fffcda247794e0972c6f39a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

3de0a3a4849fb359b503d59a389583bc1e804bbe86c29f4647bdb5953a6d8da9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows

51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows

6e65f088e4ecb0cf8306766c59190ce3efbc8a190fcbb53572cc61e35d2787f1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows

9b9bffdaa19518c516dff8fe86c72307f20fee82d7587b276135805e5494f46e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Windows

cad6471e8393046ff3c623454fc904b33e6166e58ed05f98dc36c122309db618

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Corporation

6dd62fa254c707f2512ad38e86a9b76a75b822340cd210da28215b88d18b133d

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Corporation

6b290031086ff366dd06f0e033465149dade14d092be18308fe5f37396729bd3

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Corporation

6c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll · signed by Microsoft Corporation

921b7cf74744c4336f976db6750921b2a0960e8aa11268457f5ed27c0e13b2c8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.