riched20.dll

Rich Text Edit Control, v3.1 file version info

Library on Windows 3 known copies with hashes

Is it the real riched20.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\
C:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft RichEdit Control, version 3.1, Microsoft Corporation

DescriptionRich Text Edit Control, v3.1

3 known copies

16.0.12527.20134 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\RICHED20.DLL · signed by Microsoft Corporation

260d7fd1344c987f7d266affef1bda75e035389b913e617924ba46a0d57eb26e

5.31.23.1231 · C:\Windows\system32\riched20.dll · signed by Microsoft Windows

4aa8d583491061ab27019ac1958378462bf952affb747fe90ecefd8ebec21d2f

5.31.23.1231 · C:\Windows\SysWOW64\riched20.dll · signed by Microsoft Windows

aee7ebf38be4c4ecaa858c8e201c27628e3b5bae80b820f5dc984173fdf2cdab

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.