api-ms-win-crt-time-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-time-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows

15e214446a836735fba73b2b647feac76fb6b82c307da67fed742fba96f9ce00

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows

2b7fed76ba52606e442d5069f42077f0cf304e49326dddcf3695a06530c4b5c1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

75545122365ab38b4e0f42bed59fe42126465fa3e97856788e2a4b9204dacb56

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows

9fe8435d6d007bd24e777101a95f6da76d1277b59ac385fd82f0fdd7f7df1fac

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows

ac4e636f8e32a5d0fc274b56385abfbc301b2eecd7fd76e28f3d367543e6e65f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Windows

c2c826953847a616b59eaaa261a0c7712037691dd92df01d9b339c2ba752ef1c

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Corporation

5ca96d8a7744b96fc4bb39e3d2cb53b5a34ea1c7d8887f25e4a22452e10482dd

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Corporation

4c274c90a9008434faeb3dbe884bbbe247570021317d228346335a1d6ab7a108

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Corporation

cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll · signed by Microsoft Corporation

f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.