api-ms-win-crt-utility-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 10 known copies with hashes

Is it the real api-ms-win-crt-utility-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

10 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows

023e5185cff7cd2b8add590d4bc0e3240d24895c59ca8b0495e79608fd0be88a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows

47aa51ad00153edd4f3dd42bf89da2325f9e0106e9772396c066666182b22d07

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\arm\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows Kits Publisher

996cfdcc3c706d76bd444ba89896aef3b7cec76b63cc2e5efd93e104b3619b8b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows

c604589408da77e37e9600caa6dd0f787621d7cb353f2f37e349e84785c01048

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows

e85f92bab9228a9f68ed1dd45f10fd08a6e69ceb476cb2a62a2a4b43bf572c3d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x86\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Windows

ec1c5e3c9dd3a818112b3c2920af5bc558b7ec3bcbca432e945eb712d4a0d85b

10.0.14393.33 (rs1_release_sec.160727-1952) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Corporation

0418f536442410efeb950d0c185e621a351eda2e795dcd9ed9f9aaa7f2622e0a

10.0.14388.0 (rs1_release.160709-1635) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Corporation

f4f3b610f442a354becf8cffae5fd3ec826d1aa16c4e3c3eccb25f33274bac53

10.0.10240.16384 (th1.150709-1700) · C:\Program Files (x86)\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Corporation

8858d883d180cea63e3bf4a3f5bc9e0f9fa16c9a35a84c4efe65308cea13a364

10.0.10240.16384 (th1.150709-1700) · C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll · signed by Microsoft Corporation

bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.