URLREDIR.DLL

Microsoft Office Document Cache Handler file version info

Library on Windows 2 known copies with hashes

Is it the real URLREDIR.DLL?

file version info and known copies

Original nameURLRedirection.dll in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft Office, Microsoft Corporation

DescriptionMicrosoft Office Document Cache Handler

2 known copies

16.0.12527.20470 · C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL · signed by Microsoft Corporation

65af4387d29451c5d59a3286b9eb10b99dbe2c8e0dcbaa8fc66437fa17319b01

16.0.12527.20470 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL · signed by Microsoft Corporation

ff71bcb0984adddd7a1095dd56d53660c1de6ec81156f13314487ee865afafa9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.