api-ms-win-eventing-provider-l1-1-0.dll

ApiSet Stub DLL file version info

Library on Windows 5 known copies with hashes

Is it the real api-ms-win-eventing-provider-l1-1-0.dll?

file version info and known copies

Original nameapisetstub in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionApiSet Stub DLL

5 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\api-ms-win-eventing-provider-l1-1-0.dll · signed by Microsoft Windows

cbe13288071551a911a2e16bb2669c8f2e4128cad4d21ccc94efa9ea6d731775

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\downlevel\API-MS-Win-Eventing-Provider-L1-1-0.dll · signed by Microsoft Windows

cf03057e32a0340708d8b6a626587d244af52b5ffa78e48355296e9610476ae7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\api-ms-win-eventing-provider-l1-1-0.dll · signed by Microsoft Windows

df009889930974de784fa440fdd257bac1ca86f2eed360309b543f0cf4dbab93

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\downlevel\API-MS-Win-Eventing-Provider-L1-1-0.dll · signed by Microsoft Windows

f7ca160097b11482e586807b8932b0eeede8c1601acebc3938263e6687e42d48

Version not recorded · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\api-ms-win-eventing-provider-l1-1-0.dll · not signed

ad0dcdd5781b2ad557e159f18e54252d802c808c17550ddf1eb41a813a045260

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.