api-ms-win-crt-locale-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-locale-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows

3679526600fc83b81424caf6e39010fe20a2619519a1f293aae65e1cf93169ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows

525c9a51b70233bdca0fd0dfd61d7051615616698374cea0b3ca55b8ef5792a7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows

69e5f222dc622555c88e3bc4cfef42f64237728bd02d00c9281203e512ca77b2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows

7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows

87a251a8abbfb53753d3dbf01f1603598a4af97706db145d53f19ba9d8b05a9d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

bb7c6ff95698c3398a18c9ad4d91bcbaf8a38c74819b27541b0e927113f842ac

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Corporation

bc18b13b6046ded455404d22ba7904855a5c7c5b8db2bdd609adc1da9a694bc6

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Corporation

497faae1228bcdf8207552369e9cc936a8dca024f4888ed2a2fa44f3084ba09c

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Corporation

e087f611b3659151dfb674728202944a7c0fe71710f280840e00a5c4b640632d

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll · signed by Microsoft Corporation

fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.