CmdID / Files

riched32.dll

Wrapper Dll for Richedit 1.0 file version info

Library on Windows 2 known copies with hashes

Is it the real riched32.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWrapper Dll for Richedit 1.0

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\riched32.dll · signed by Microsoft Windows

b50dcd7095a3b62415fb6c876804a1611ad94a11fc489d298479818e425a8ad0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\riched32.dll · signed by Microsoft Windows

f849fc587c04e595cc65af82c7b07205560890b50ddf7b2c579b98a7a3c84236

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.