File Name | zthelper.dll |
File Type |
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
Scanner Version | 1.0.217.174 |
Database Version | 2025-05-31 18:00:18 UTC |
No threats detected by our scanner
Hash Type | Value | Action |
---|---|---|
MD5 |
88099061860a6955a8abae1056170064
|
|
SHA1 |
493a5e01a0535c495b7eab6776c1509945b1c48d
|
|
SHA256 |
bf9bcac3da3f8d9dc4fa65dea9d71b21a36cacb65c43d074f4872eb234c53534
|
|
SHA512 |
f90a01d10a07d1b6002eba7759c984a136c5278ab402a0a8c712fbfe72ef7ea5a9ee75d31f374f54914f61abf9b14c4a2d3a42a98c92c698fdfe225c585ff000
|
|
ImpHash |
296c7304343f1406b3585f52dee4b70d
|
Image Base | 0x180000000 |
Entry Point | 0x1800014a0 |
Compilation Time | 1970-10-31 13:14:17 |
Checksum | 0x0002c1f2 (Actual: 0x0002c1f2) |
OS Version | 10.0 |
PEiD Signatures |
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
PDB Path | zthelper.pdb |
Digital Signature | OK |
Imports | 29 libraries |
Exports | 2 functions |
Resources | 2 Resources |
Sections | 8 Sections |
CompanyName | Microsoft Corporation |
FileDescription | ZTHELPER |
FileVersion | 10.0.26100.3912 (WinBuild.160101.0800) |
InternalName | ZTHELPER.dll |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | ZTHELPER.dll |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 10.0.26100.3912 |
Translation | 0x0409 0x04b0 |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
75,704 bytes | 77,824 bytes | 6.22 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
0173E61F2AD39E01C7F7CCC337A1BA24 |
_wpp_sf |
0x00014000 |
7,445 bytes | 8,192 bytes | 5.49 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
95CB65512979D67131CC38857989702F |
fothk |
0x00016000 |
4,096 bytes | 4,096 bytes | 0.02 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
56C30C114FAA0C65FFFCB24D0F771D6D |
.rdata |
0x00017000 |
23,146 bytes | 24,576 bytes | 4.52 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B0D6EBC19B19A4F4BE62BAB0C3CC53BF |
.data |
0x0001d000 |
3,160 bytes | 4,096 bytes | 0.35 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
6E8738BC79B02283DC659F95DF7658EA |
.pdata |
0x0001e000 |
3,540 bytes | 4,096 bytes | 4.51 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E280C3861FFCAF22E945A95FD22AACE9 |
.rsrc |
0x0001f000 |
1,280 bytes | 4,096 bytes | 1.30 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
5D41A5C0DCA5F82EF751396A807300FB |
.reloc |
0x00020000 |
680 bytes | 4,096 bytes | 1.35 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
E4D12962F0914D956E30868C7EFD238E |
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
MUI | 1 | 200 bytes | |
RT_VERSION | 1 | 904 bytes |
Product | Microsoft® Windows® Operating System |
Description | ZTHELPER |
File Version | 10.0.26100.3912 (WinBuild.160101.0800) |
Original Name | ZTHELPER.dll |
Signing Date | 04:30 AM 04/18/2025 (48 days ago) |
Verification Status | Signed |
Signers | Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010 |
Counter Signers | Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010 |
Internal Name | ZTHELPER.dll |
Copyright | © Microsoft Corporation. All rights reserved. |
33 00 00 04 A7 04 3E E4 22 C8 34 FA FC 00 00 00 00 04 A7
61 07 76 56 00 00 00 00 00 08
33 00 00 02 08 78 9D 58 5D 92 C7 D9 52 00 01 00 00 02 08
33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15
✓ This file has been digitally signed and the certificate chain has been verified
OK
Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:
Download Anti-MalwareThis file appears clean, but regular security maintenance is important