api-ms-win-crt-string-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-string-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows

11311e78b47ce86cbce9d3fba59a8cabad36874f3fe58b4be6efaaf40a5e318b

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows

341f489491f992bece2879fea3b660ff2dcd04a59bdb5f3998d58e5ac8ce3341

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows

6385565a417feb3cf7165244826479d2ee12215eee930390b3ad28ee3608af12

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows

91939ef769895f2dc0609b0619c7814d37ef46e28c3f54ad0c998d42c73474c7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

b37d81a91ff821a71c372e8308d6848239e09a3b462973a475f088a591536db2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Windows

bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Corporation

554e7f8d9987ded1d69b52cc5e3d2979618722469ec96848aaeed0d853cb0180

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Corporation

8dd250dc54448fc356b58a06b45430fb6d5322e2de2d39105142751df28a88cc

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Corporation

01e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll · signed by Microsoft Corporation

44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.