CmdID

CmdID / Files

api-ms-win-crt-private-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 9 known copies with hashes

Is it the real api-ms-win-crt-private-l1-1-0.dll?

file version info and known copies
Original nameapisetstub in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Microsoft Office\root\Client\
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApiSet Stub DLL

9 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

0ecf50eb415d470ce53930be8d7e933df01bcd321e92d55606d2706045554ff8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows

77992fb879a7e0977858bae7dd87b73f7d4219f926c9b4c595e1a957a53acab7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows

c65e7b9671d7263622761d70591a5c55f47d1f745e4dde62712e9c211b50fbf3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows

cca7300bce657ad70666686667d1997b5c5238006a71f833b079dfbcd15468f4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows

fb3d921311b54253cb93a1dd0cd8db7ca96463bfe40cccdd3f96d19b58757708

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Windows

fc0893026981e1a4a62f203fea4edad61ba8b385122cb68aa4d2376f9082345a

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Corporation

a7b3ed8c2ff8d6c700461161885a1d729f80c70ed16d4a28649485dd14a4d85c

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Corporation

ccaf41e616b9a872d35c8083cbf8fdc14371fa3ef159fe699514643c26a4ebf3

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll · signed by Microsoft Corporation

d0ff5f6bb94961d4c17f0709297a6b5a5fa323c9ac82f4fe27187912b4b13cf3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.