Should I block it?

No, this file is 100% safe to run.

Additional versions

f3840	0.27%
1b89c	1.51%
6b220	0.14%
a0ff4	48.83%
89525	14.54%
b2d01	16.32%
96efe	17.70%
2665e	0.14%
2bfdf	0.41%
71a9a	0.14%

(Note, RealNetworks publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegQueryValueExA, CloseServiceHandle, CreateServiceA, OpenSCManagerA, DeleteService, OpenServiceA, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, RegCreateKeyExA, RegNotifyChangeKeyValue, RegOpenKeyExA, RegCloseKey, RegSetValueExA, RegDeleteKeyA, RegOpenKeyExW, RegQueryValueExW

kernel32.dll

HeapSize, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetProcessHeap, LeaveCriticalSection, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, DecodePointer, EncodePointer, HeapSetInformation, InterlockedCompareExchange, Sleep, InterlockedExchange, GetEnvironmentVariableA, GetCurrentProcess, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetTickCount, GetFileAttributesA, WaitForMultipleObjects, MoveFileA, lstrlenW, WideCharToMultiByte, lstrlenA, EnterCriticalSection, MultiByteToWideChar, LoadLibraryA, GetProcAddress, FreeLibrary, GetLastError, RaiseException, lstrcmpiA, CreateEventA, WaitForSingleObject, CloseHandle, SetEvent, GetModuleFileNameA, InitializeCriticalSection

msvcr100.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

CoInitialize, CoUninitialize

shell32.dll

SHGetFolderPathW, SHCreateDirectoryExW, SHFileOperationW

shlwapi.dll

PathAppendW

user32.dll

GetSystemMetrics, CharNextA

rndlresolversvc.exe

By RealNetworks (Signed)

Remove rndlresolversvc.exe

MD5:	f38405956c690af82cf913fd66e658a1
SHA1:	6611ead0183166782760cdf1209eee6d92edba7b
SHA256:	734394d7028ab5df9a854cf962dc55ba9b3f3bdae36d9f790fd985b62349ea16

Overview

rndlresolversvc.exe runs as a service under the name RealNetworks Downloader Resolver Service with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including RealDownloader published by RealNetworks, Inc. and Facebook Video Calling 1.2.0.159 published by Skype Technologies S.A.. The file is digitally signed by RealNetworks which was issued by the Thawte certificate authority (CA).

Details

File name:	rndlresolversvc.exe
Typical file path:	C:\Program Files\realnetworks\realdownloader\rndlresolversvc.exe
Size:	31.17 KB (31,920 bytes)
Certificate
Issued to:	RealNetworks
Authority (CA):	Thawte
Effective date:	Tuesday, March 8, 2011
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C++ 10.0
.NET CLR:	No

More details

Programs

The following programs will install this file

RealDownloader

RealNetworks, Inc.

27% remove

RealDownloader is a freemium download manager by RealNetworks that downloads embedded Internet videos in multiple formats including MOV and FLV from sites such as Youtube. This software utility lets users share downloaded videos on social networks and transfer them to their mobile devices. The freeware version includes automatic embedded video detection and integration with web browsers such as Google Chrome, Internet Explorer and Mozil...

Facebook Video Calling

Skype Technologies S.A.

9% remove

The video calling feature in Facebook powered by Skype is an in-browser Skype-based video chat which enables users to video conference their Facebook friends. Facebook provides users with two choices to initiate a call. You can choose someone from your online Facebook chat contacts and then hit the video button in the discussion window. Features: - Face-to-face video calls - Video call button at the top of the chat window - Add e...

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'RealNetworks Downloader Resolver Service'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00005647%	0.028634%
Kernel CPU:	0.00002823%	0.013761%
User CPU:	0.00002823%	0.014873%
Kernel CPU time:	31 ms/min	100,923,805ms/min
Memory
Private memory:	1.14 MB	21.59 MB
Private (maximum):	3.77 MB
Private (minimum):	140 KB
Non-paged memory:	1.14 MB	21.59 MB
Virtual memory:	44.21 MB	140.96 MB
Virtual memory (peak):	45.46 MB	169.69 MB
Working set:	576 KB	18.61 MB
Working set (peak):	3.77 MB	37.95 MB
Resource allocations
Threads:	4	12
Handles:	67	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\realnetworks\realdownloader\rndlresolversvc.exe"
Owner:	SYSTEM
Windows Service
Service name:	RealNetworks Downloader Resolver Service
Description:	“Manage different Downloader versions in RealNetworks' products.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	33.50%
Windows 7 Ultimate	19.50%
Microsoft Windows XP	14.50%
Windows 7 Professional	5.50%
Windows 8	4.00%
Windows 8.1	4.00%
Windows 8 Pro	3.50%
Windows Vista Home Premium	3.50%
Windows 7 Home Basic	3.00%
Windows 8 Enterprise	2.00%
Windows 8 Enterprise N	1.00%
Windows 8 Enterprise Evaluation	1.00%
Windows 7 Starter	1.00%
Windows 8 Single Language	1.00%
Windows Se7en Titan	1.00%
Windows Vista Home Basic	1.00%
Windows Vista Business	1.00%

Distribution by country

United States installs about 40.91% of rndlresolversvc.exe.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	25.83%
Hewlett-Packard	15.50%
Lenovo	13.28%
Toshiba	8.12%
Sony	7.38%
Acer	7.01%
GIGABYTE	6.27%
ASUS	5.90%
Compaq	4.43%
Intel	1.48%
Sahara	1.48%
NEC	1.48%
American Megatrends	1.11%
Samsung	0.74%

Remove Adware and Spyware Programs, FREE Download!