ReAgent.dll

File Path: C:\Windows\SysWOW64\ReAgent.dll
Description: Microsoft Windows Recovery Agent DLL

Hashes

Type	Hash
MD5	`6FBEC878D0221C71E82265A571FC333C`
SHA1	`67784BC13759FF7B61ED542A9C24B45AE31E4F12`
SHA256	`2D346CC1B7C92AB93E9FF6ADD455E8E0F1FAEF85A139A8BB014D63AA99E4A253`
SHA384	`939DEEB2B03287E8B1B61023DD6EAD0B9B0ADCBC662C00974ECD48F923EC7CDEACAC244C86D4221FC31093441E712BD8`
SHA512	`380A8352AB48BCBFEB9C59FB238D2CE8F3FDB398F456E4A964AA88F299C93C0FC7BDE97BB6CF4B711F08DBEE73431341B0C1C6FA1859D03E033C8C13B0BCF27B`
SSDEEP	`24576:splkJI0cii0nO3X7Wdj3E3b23NF+UgVKUHvY4s:snFHXB7WRs23V4XHJs`
IMP	`72ABD3C448609C7ACF7D6DB9EFF5EADD`
PESHA1	`34B1EC16149BC5AB83461E27BA71CBA0EE33CA93`
PE256	`8C5ADD5055CB1275D00525EE52A17D634B91B40459686B51791A6109C48FAF98`

DLL Exports:

Function Name	Ordinal	Type
`WinReRestoreLogFiles`	38	Exported Function
`WinReRestoreConfigAfterPBR`	4	Exported Function
`WinReRepair`	37	Exported Function
`WinReSetBootApp`	39	Exported Function
`WinReSetError`	42	Exported Function
`WinReSetCustomization`	41	Exported Function
`WinReSetConfig`	40	Exported Function
`WinReOpenLogInstance`	32	Exported Function
`WinReOobeInstall`	31	Exported Function
`WinReIsWinPE`	30	Exported Function
`WinRePostBCDRepair`	33	Exported Function
`WinReRemoveTrustedBootApp`	36	Exported Function
`WinReReinstall`	35	Exported Function
`WinReQueueRecoveryBoot`	34	Exported Function
`WinReSetNarratorScheduled`	43	Exported Function
`WinReUnInstall`	53	Exported Function
`WinReSetupSetImage`	52	Exported Function
`WinReSetupRestoreWinREEx`	51	Exported Function
`WinReUpdateLogInstance`	54	Exported Function
`WinReValidateWimFile`	56	Exported Function
`WinReValidateRecoveryWim`	55	Exported Function
`WinREUseNewPBRImage`	6	Exported Function
`WinReSetupBackupWinRE`	46	Exported Function
`WinReSetTriggerFile`	45	Exported Function
`WinReSetRecoveryAction`	44	Exported Function
`WinReSetupCheckWinRE`	47	Exported Function
`WinReSetupRemoveWinRE`	50	Exported Function
`WinReSetupMigrateData`	49	Exported Function
`WinReSetupInstall`	48	Exported Function
`WinReCopyDiagnosticFiles`	12	Exported Function
`WinReConfigureTask`	11	Exported Function
`WinReClearOemImagePath`	3	Exported Function
`WinReCopyLogFilesToRamdisk`	13	Exported Function
`WinReDeleteLogFiles`	16	Exported Function
`WinReCreateLogInstanceEx`	15	Exported Function
`WinReCreateLogInstance`	14	Exported Function
`WinRE_Specialize_Offline`	2	Exported Function
`WinRE_Specialize`	1	Exported Function
`WinRE_Generalize`	7	Exported Function
`WinReAddTrustedBootApp`	8	Exported Function
`WinReClearError`	10	Exported Function
`WinReClearBootApp`	9	Exported Function
`WinRECheckGuid`	5	Exported Function
`winreFindInstallMedia`	57	Exported Function
`WinReInitiateOfflineScanning`	25	Exported Function
`WinReHashWimFile`	24	Exported Function
`WinReHashBootApp`	23	Exported Function
`WinReInstall`	26	Exported Function
`WinReIsWimBootEnabled`	29	Exported Function
`WinReIsInstalledOnSystemPartition`	28	Exported Function
`WinReInstallOnTargetOS`	27	Exported Function
`WinReGetCustomization`	18	Exported Function
`WinReGetConfig`	17	Exported Function
`winreGetBinaryArch`	58	Exported Function
`WinReGetError`	19	Exported Function
`WinReGetWIMInfo`	22	Exported Function
`WinReGetTrustedBootApps`	21	Exported Function
`WinReGetLogDirPath`	20	Exported Function

Signature

Status: Signature verified.
Serial: 3300000266BD1580EFA75CD6D3000000000266
Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: reagent.dll
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.84 (WinBuild.160101.0800)
Product Version: 10.0.19041.84
Language: English (United States)
Machine Type: 32-bit

File Scan

VirusTotal Detections: 0/71
VirusTotal Link: https://www.virustotal.com/gui/file/2d346cc1b7c92ab93e9ff6add455e8e0f1faef85a139a8bb014d63aa99e4a253/detection/