» RShellEx.DLL
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

RShellEx.DLL

Macrium Reflect Shell Extensions

Paramount Software UK Ltd

This is installed with multiple programs including Macrium Reflect Server Plus Edition and Macrium Reflect Home Edition.

File name:

RShellEx.DLL

Publisher:

Paramount Software UK Ltd (signed and verified)

Product:

Macrium Reflect Shell Extensions

Version:

7, 0, 2079, 0

MD5:

a77f443255c23ada2401df1d1d23448a

SHA-1:

d197dfafa1eae329bd232c90275a6e488f80e79a

SHA-256:

2ea6408e3abc63fbff15651d2821a971e6694163ff029accec685fbffd574708

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/27/2024 6:25:33 AM UTC (today)

File size:

7.8 MB (8,146,760 bytes)

Product version:

7, 0, 2079, 0

Original file name:

RShellEx.DLL

File type:

Dynamic link library (Win64 DLL)

Language:

English (United States)

Common path:

C:\Program Files\macrium\reflect\rshellex.dll

Digital Signature

Signed by:

Paramount Software UK Ltd

Authority:

GlobalSign nv-sa

Valid from:

2/16/2017 10:47:48 AM

Valid to:

3/24/2020 3:06:23 PM

Subject:

CN=Paramount Software UK Ltd, O=Paramount Software UK Ltd, L=Manchester, S=Greater Manchester, C=GB

Issuer:

CN=GlobalSign CodeSigning CA - G3, O=GlobalSign nv-sa, C=BE

Serial number:

7C4BA269A79BFCBA77F289AA

Registration

CLSID:

{2141C592-6921-4117-A07C-03882052F93D}

ProgID:

ReflectContextMenu.ContextMenuExtension

COM registered:

Yes

File PE Metadata

Compilation timestamp:

3/16/2017 1:58:07 AM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

11.0

Entry address:

0x41DB40

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 7B, 5A, 01, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, F4, 40, 29, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF... 
[+]

Entropy:

6.1068

Code size:

4.9 MB (5,106,176 bytes)

Approved Shell Extension

Name:

CReflectPropertySheet

CLSID:

{E5EA40FC-0B47-4100-A854-D98E0519F299}

CLSID name:

ReflectPropertySheet.PropertySheetExtension

The file RShellEx.DLL has been discovered within the following programs.

Macrium Reflect Home Edition by Paramount Software (UK) Ltd.

www.macrium.com/default.aspx

About 2% of users remove it

Macrium Reflect Server Plus Edition by Paramount Software (UK) Ltd.

About 4% of users remove it

Scan RShellEx.DLL - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.