tbauth.dll
TBAuth protocol handler file version info
Library on Windows 2 known copies with hashes
Is it the real tbauth.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTBAuth protocol handler
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tbauth.dll · signed by Microsoft Windows
66a6148baa79ed92cd83e4718b8145ddf1b9aaf157551aface64fd0a6d4cb84810.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tbauth.dll · signed by Microsoft Windows
6b1538d1a597b13ae993ecfd4268d729dd281f3ff6d686e05c3e136c7d0c8cadFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.