api-ms-win-downlevel-kernel32-l2-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 2 known copies with hashes

Is it the real api-ms-win-downlevel-kernel32-l2-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\api-ms-win-downlevel-kernel32-l2-1-0.dll · not signed

7c9993bb853fab0c9383a22dbcc972f9e9b447adf91ff43e36167fc54b94172d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\api-ms-win-downlevel-kernel32-l2-1-0.dll · not signed

bf50b9715c9e9acf701d3f340fdabac804f6029ebfa1d12314085218f8882ef0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.