文件名 | zthelper.dll |
文件类型 |
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
扫描器版本 | 1.0.217.174 |
数据库版本 | 2025-05-31 18:00:18 UTC |
我们的扫描器未检测到威胁
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
88099061860a6955a8abae1056170064
|
|
SHA1 |
493a5e01a0535c495b7eab6776c1509945b1c48d
|
|
SHA256 |
bf9bcac3da3f8d9dc4fa65dea9d71b21a36cacb65c43d074f4872eb234c53534
|
|
SHA512 |
f90a01d10a07d1b6002eba7759c984a136c5278ab402a0a8c712fbfe72ef7ea5a9ee75d31f374f54914f61abf9b14c4a2d3a42a98c92c698fdfe225c585ff000
|
|
ImpHash |
296c7304343f1406b3585f52dee4b70d
|
映像基址 | 0x180000000 |
入口点 | 0x1800014a0 |
编译时间 | 1970-10-31 13:14:17 |
校验和 | 0x0002c1f2 (实际: 0x0002c1f2) |
操作系统版本 | 10.0 |
PEiD 签名 |
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
PDB 路径 | zthelper.pdb |
数字签名 | OK |
导入 | 29 库 |
导出 | 2 函数 |
资源 | 2 资源 |
节 | 8 节 |
CompanyName | Microsoft Corporation |
FileDescription | ZTHELPER |
FileVersion | 10.0.26100.3912 (WinBuild.160101.0800) |
InternalName | ZTHELPER.dll |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | ZTHELPER.dll |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 10.0.26100.3912 |
Translation | 0x0409 0x04b0 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
75,704 bytes | 77,824 bytes | 6.22 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
0173E61F2AD39E01C7F7CCC337A1BA24 |
_wpp_sf |
0x00014000 |
7,445 bytes | 8,192 bytes | 5.49 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
95CB65512979D67131CC38857989702F |
fothk |
0x00016000 |
4,096 bytes | 4,096 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
56C30C114FAA0C65FFFCB24D0F771D6D |
.rdata |
0x00017000 |
23,146 bytes | 24,576 bytes | 4.52 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B0D6EBC19B19A4F4BE62BAB0C3CC53BF |
.data |
0x0001d000 |
3,160 bytes | 4,096 bytes | 0.35 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
6E8738BC79B02283DC659F95DF7658EA |
.pdata |
0x0001e000 |
3,540 bytes | 4,096 bytes | 4.51 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E280C3861FFCAF22E945A95FD22AACE9 |
.rsrc |
0x0001f000 |
1,280 bytes | 4,096 bytes | 1.30 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
5D41A5C0DCA5F82EF751396A807300FB |
.reloc |
0x00020000 |
680 bytes | 4,096 bytes | 1.35 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
E4D12962F0914D956E30868C7EFD238E |
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
MUI | 1 | 200 字节 | |
RT_VERSION | 1 | 904 字节 |
产品 | Microsoft® Windows® Operating System |
描述 | ZTHELPER |
文件版本 | 10.0.26100.3912 (WinBuild.160101.0800) |
原始名称 | ZTHELPER.dll |
签名日期 | 04:30 AM 04/18/2025 (50 天前) |
验证状态 | Signed |
签名者 | Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010 |
副签名者 | Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010 |
内部名称 | ZTHELPER.dll |
版权 | © Microsoft Corporation. All rights reserved. |
33 00 00 04 A7 04 3E E4 22 C8 34 FA FC 00 00 00 00 04 A7
61 07 76 56 00 00 00 00 00 08
33 00 00 02 08 78 9D 58 5D 92 C7 D9 52 00 01 00 00 02 08
33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15
✓ 此文件已进行数字签名,证书链已验证。
OK
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断:
下载反恶意软件此文件看起来是干净的,但定期的安全维护很重要