api-ms-win-crt-multibyte-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-multibyte-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

37a901db2b6826ff38683080840ae3422b1f731d7b8e5dea8c563f79f4967108

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows

622246592d9b118ffcf2a30ef619d0a81d921dac5735362050093471d6c9ffea

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows

996b63255e2f1e366f520a6d09352d2829e92f6b34f2d98448c4fd33ae4c06d1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows

9ba3c364897009cb7f9d22e656dcdea154b437d9cc2a81969ab11d72e861b491

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows

c4495bf03e5d3067eac5bdc9c65d3d5c622b545439bdbc68c14ffbc4022b4ac4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Windows

d1b720ee0c34f72467aca491922b75e1bf08a71236926d96f65588a164659547

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Corporation

b31ae454e2269ce96e2ded6f4ad147c038134c3e8647df8f7cfbfebd9fb6ed03

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Corporation

7c6ec95a166d5ce9626607d0bfafff875c2cd4ba22d22636f873b4d126339768

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Corporation

b52f2b9de19d12b0e727e13e3dde93009e487bfb2dd97fd23952c7080949d97e

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll · signed by Microsoft Corporation

d7e676b9f1e162957d0549ab0b91e2cd754643490b0654bf9a86aa1e77cb3c37

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.