CmdID / Files

msoetwres.dll

Microsoft Office component file version info

Library on Windows 1 known copy with hashes

Is it the real msoetwres.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft Office, Microsoft Corporation

DescriptionMicrosoft Office component

1 known copy

16.0.11126.20010 · C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll · signed by Microsoft Corporation

SHA-256e6ae62935c28e2c836d3c85e5f5942cc28baa9822566657c1febfc920fec49a8SHA-1a9c47a1e5bc9e88cb9871975bcd367a153d12fb6MD5b5b19692ae0db188a033f916f14c24f5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.