TlbImp.exe
Microsoft .NET Assembly to Type Library Converter file version info
Program on Windows 2 known copies with hashes
Is it the real TlbImp.exe?
Installed in
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\Signed byMicrosoft Corporation
ProductMicrosoft .NET Framework, Microsoft Corporation
DescriptionMicrosoft .NET Assembly to Type Library Converter
2 known copies
4.8.4084.0 built by: NET48REL1 · C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\TlbImp.exe · signed by Microsoft Corporation
75e2a025f5b20ba324ab0dbcf877f3fb3a9467d4736cb2bfba9b79efc68afb044.8.4084.0 built by: NET48REL1 · C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\TlbImp.exe · signed by Microsoft Corporation
b03269a241b248f8703d0eef439b5318a3f53b2d26bdb2ddb9b771abc5074407From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.