Should I block it?

No, this file is 100% safe to run.

Additional versions

f3840	0.27%
1b89c	1.51%
6b220	0.14%
a0ff4	48.83%
89525	14.54%
b2d01	16.32%
96efe	17.70%
2665e	0.14%
2bfdf	0.41%
71a9a	0.14%

(Note, RealNetworks publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegQueryValueExA, CloseServiceHandle, CreateServiceA, OpenSCManagerA, DeleteService, OpenServiceA, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, RegCreateKeyExA, RegNotifyChangeKeyValue, RegOpenKeyExA, RegCloseKey, RegSetValueExA, RegDeleteKeyA, RegOpenKeyExW, RegQueryValueExW

kernel32.dll

HeapSize, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetProcessHeap, LeaveCriticalSection, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, DecodePointer, EncodePointer, HeapSetInformation, InterlockedCompareExchange, Sleep, InterlockedExchange, GetEnvironmentVariableA, GetCurrentProcess, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetTickCount, GetFileAttributesA, WaitForMultipleObjects, MoveFileA, lstrlenW, WideCharToMultiByte, lstrlenA, EnterCriticalSection, MultiByteToWideChar, LoadLibraryA, GetProcAddress, FreeLibrary, GetLastError, RaiseException, lstrcmpiA, CreateEventA, WaitForSingleObject, CloseHandle, SetEvent, GetModuleFileNameA, InitializeCriticalSection

msvcr100.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

CoInitialize, CoUninitialize

shell32.dll

SHGetFolderPathW, SHCreateDirectoryExW, SHFileOperationW

shlwapi.dll

PathAppendW

user32.dll

GetSystemMetrics, CharNextA

rndlresolversvc.exe

By RealNetworks (Signed)

Remove rndlresolversvc.exe

MD5:	b2d01290c0e0465aca54c2088e947823
SHA1:	9572f41aceb5999f17da9628ed0d80e96e9c1d4d
SHA256:	6fb6e6cfaf3f2f948b753a0cff6f9058bf3ed0e421204ee58848f0dfd694a747

Overview

rndlresolversvc.exe runs as a service under the name RealNetworks Downloader Resolver Service with extensive SYSTEM privileges (full administrator access). The file is digitally signed by RealNetworks which was issued by the Thawte certificate authority (CA).

Details

File name:	rndlresolversvc.exe
Typical file path:	C:\Program Files\realnetworks\realdownloader\rndlresolversvc.exe
Size:	38.14 KB (39,056 bytes)
Build date:	4/16/2013 5:07 AM
Certificate
Issued to:	RealNetworks
Authority (CA):	Thawte
Effective date:	Tuesday, March 8, 2011
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C++ 10.0
.NET CLR:	No

More details

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'RealNetworks Downloader Resolver Service'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00029116%	0.028634%
Kernel CPU:	0.00022256%	0.013761%
User CPU:	0.00006860%	0.014873%
Kernel CPU time:	63,067 ms/min	100,923,805ms/min
CPU cycles:	6,519/sec	17,470,203/sec
Memory
Private memory:	1.4 MB	21.59 MB
Private (maximum):	4.63 MB
Private (minimum):	2.59 MB
Non-paged memory:	1.4 MB	21.59 MB
Virtual memory:	39.03 MB	140.96 MB
Virtual memory (peak):	41.08 MB	169.69 MB
Working set:	3.23 MB	18.61 MB
Working set (peak):	5.17 MB	37.95 MB
Page faults:	1,937/min	2,039/min
I/O
I/O read transfer:	158 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	15 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	70	600
GUI GDI count:	4	103
GUI USER count:	3	49

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Program Files\realnetworks\realdownloader\rndlresolversvc.exe"
Owner:	SYSTEM
Windows Service
Service name:	RealNetworks Downloader Resolver Service
Description:	“Manage different Downloader versions in RealNetworks' products.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

msvcr100.dll (Microsoft Visual Studio 2010 by Microsoft)
Total CPU:	0.00093126%	0.272967%
Kernel CPU:	0.00085764%	0.107585%
User CPU:	0.00007362%	0.165382%
CPU cycles:	10,174/sec	5,741,424/sec
Memory:	764 KB	1.16 MB
rndlresolversvc.exe (main module)
Total CPU:	0.00026605%
Kernel CPU:	0.00015406%
User CPU:	0.00011199%
CPU cycles:	4,795/sec
Memory:	44 KB
wow64.dll
Total CPU:	0.00004744%
Kernel CPU:	0.00004744%
User CPU:	0.00000000%
CPU cycles:	56/sec
Memory:	276 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	33.50%
Windows 7 Ultimate	19.50%
Microsoft Windows XP	14.50%
Windows 7 Professional	5.50%
Windows 8	4.00%
Windows 8.1	4.00%
Windows 8 Pro	3.50%
Windows Vista Home Premium	3.50%
Windows 7 Home Basic	3.00%
Windows 8 Enterprise	2.00%
Windows 8 Enterprise N	1.00%
Windows 8 Enterprise Evaluation	1.00%
Windows 7 Starter	1.00%
Windows 8 Single Language	1.00%
Windows Se7en Titan	1.00%
Windows Vista Home Basic	1.00%
Windows Vista Business	1.00%

Distribution by country

United States installs about 40.91% of rndlresolversvc.exe.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	25.83%
Hewlett-Packard	15.50%
Lenovo	13.28%
Toshiba	8.12%
Sony	7.38%
Acer	7.01%
GIGABYTE	6.27%
ASUS	5.90%
Compaq	4.43%
Intel	1.48%
Sahara	1.48%
NEC	1.48%
American Megatrends	1.11%
Samsung	0.74%

Remove Adware and Spyware Programs, FREE Download!