GridinSoft Threat Intelligence

RDLMA.exe file report

Under review File reputation report
MD5 e1d499c501dc2e1f8b451f1a43bfabed
Latest seen 2021-04-05 20:27:04 (5 years ago)
First seen 2017-08-12 03:08:09 (8 years ago)
Size 54 KB
Publisher Microsoft Corporation
Product Windows Installer - Unicode

Why it matters

Evidence available for this file

Detection

No final classification is available yet.

Timeline

First seen 2017-08-12 03:08:09 (8 years ago); latest analysis 2021-04-05 20:27:04 (5 years ago).

Publisher context

Company metadata: Microsoft Corporation. Product metadata: Windows Installer - Unicode.

Aliases

This hash has appeared under multiple file names, which can happen with repackaging, bundling, or deliberate renaming.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Use the hash and metadata below to verify the exact file identity.
  2. Review publisher, signature, paths, and PE details for inconsistencies.
  3. Run a local scan if the file appears unexpectedly or starts with Windows.

File context

RDLMA.exe is a Windows file recorded in the ThreatInfo database. It is associated with Windows Installer - Unicode. The reported company name is Microsoft Corporation. The current detection status is Undefined, based on the latest analysis from 2021-04-05 20:27:04 (5 years ago).

ThreatInfo does not have a final classification for this file yet. Use the technical details below to compare the hash, size, signature, and observed locations with the copy found on your device.

File Details

Product Name: Windows Installer - Unicode
Company Name: Microsoft Corporation
MD5: e1d499c501dc2e1f8b451f1a43bfabed
Size: 54 KB
First Published: 2017-08-12 03:08:09 (8 years ago)
Latest Published: 2021-04-05 20:27:04 (5 years ago)
Status: Undefined (on last analysis)
Analysis Date: 2021-04-05 20:27:04 (5 years ago)

Common Places:

%windir%\syswow64
%sysdrive%\rei\temp\20150418_1606\windows8.1_sp0_home_deu(1031)_ie11_wmp12_64bit\images
%profile%
%localappdata%
%appdata%
%system%
%commondir%

ThreatInfo has observed RDLMA.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

File Names:

403 observed names
msiexec.exe 32b219753cfe2cee13a5c6cdfa4398a571462305.img nEyUEA.exe EITaszpFi.exe kQoJOAuX.exe iaiyR.exe UAYoBE.exe FautnYeVLOtYa.exe eylIDI.exe WzPAcbqBNIuy.exe eEiehYMnUAM.exe TGyEY.exe iWHo.exe gYEOrIMIcVxm.exe OUvNuByFxz.exe UQHArR.exe Sjoc.exe EYLDm.exe qHabFHEV.exe keowN.exe bIjWvaf.exe sAsUcp.exe YiYnQYZRAU.exe ABoMeTBucM.exe UviAgxwb.exe UAoIENeeePmUb.exe OOveRIOYAEE.exe VUoCfOiodP.exe rELENqynaD.exe YdOqrieWeyEle.exe USYIoidKgthEe.exe vhrEAAe.exe vOyOUoioe.exe TRrOOyIuat.exe xyUCNOFai.exe YYFImaIoaSuz.exe uaYb.exe WEyE.exe yoOuKcUe.exe ciNbuompJQcQ.exe IYyCluaWRwhM.exe CURpJigyhE.exe YKpiCzHEqK.exe qEILUUuw.exe fGNydvU.exe OLysUizVY.exe oECaQiwXrUvU.exe uOdYeVVmzefnb.exe BdtjAfaiPdEU.exe IyAOfRDLrofK.exe jnvIOvYYo.exe HZyUUqoYEZ.exe YIEKwEIEbet.exe BaEeh.exe oxOtOOmiCwLY.exe lkmy.exe vGjVKUoTKc.exe KfSbl.exe AdoIQiOPtbADe.exe yAivoHOLeAhM.exe UBSBy.exe YEnzFIoWPgoV.exe QuyyeuCAaKoi.exe Etad.exe OyiOa.exe OSsYIIlzypuo.exe fvoAhOioUoE.exe byhaaSkoUWLaP.exe FaeAIkYXIuU.exe PVaOgiYUkEu.exe AyXanJuuEyI.exe nKsCIYes.exe MAieIya.exe IIutvFwecOi.exe eYuY.exe yJUBUaeHkaukN.exe VyzkwKA.exe UvQiaeOUi.exe YbZxHoqAeAvl.exe nOgEgtaO.exe yICueop.exe yzOuElYiDdFiD.exe UmrYOAFuVyVMz.exe eEuMQayVc.exe UvMiOYAyyIKAl.exe EgooARAaAsjvE.exe yxuwQE.exe nDCKzjEZCUZT.exe oxmEiogC.exe RYnuaQn.exe aOKkAIZhY.exe JydSwK.exe HAoc.exe eEBymUeIwOage.exe QyJofWsihYYo.exe qfFhn.exe XOYlAtaaeI.exe IhUIPh.exe qEZQBpZkEAgO.exe UFiEa.exe EqiOTL.exe oSruECbUBIq.exe DAYOeuAs.exe OcgeiNBuU.exe XoaYyvUgQTAv.exe iJYSyAoae.exe yoVOBYreGyrO.exe yJsQeo.exe zAAI.exe orUfOAI.exe IoPM.exe nVIIRii.exe DItIieaFOCjK.exe UMNHNUbE.exe wCwMoYenX.exe UnAcif.exe WJOu.exe yPkgUzaX.exe eEbIqooopiM.exe tDROJoEiTOApz.exe yAAiaEIyocxK.exe LvsfxoCVbG.exe vAOKiU.exe yaHn.exe TYAwhAYkUt.exe iAiYUATe.exe HGIoaAiIS.exe mraAuoVyaCT.exe UUFRxoIeHG.exe umiFObD.exe yfvKIDeCezOo.exe AFDMUa.exe USGEYdgvYNaA.exe JUaIaeMIuUk.exe UBEUyq.exe DPUOydayog.exe feiuyhyupUx.exe OEmAILyFI.exe BOGt.exe sDAT.exe UIQyZhOYVuy.exe FxYYiiheu.exe zziEIGq.exe YuoaaU.exe fYies.exe aOAO.exe ZqOouEE.exe UfaaiKeqAmY.exe gIhOtKu.exe YOKl.exe YEOAeeBXyzwy.exe CAOjYpvjuPI.exe uaOXoV.exe KMYABKeBuYALZ.exe YVIEoYT.exe vlYEHZamf.exe uWeyha.exe huUC.exe nJzv.exe IhaXqfXJxC.exe iaaoDIR.exe UHZYGOoAOo.exe eQoWTTgaS.exe QEIiUyiG.exe jXOtpOfYWuIEY.exe jEaJGeYvXUYNI.exe HeNjgps.exe OoyiAyYUZma.exe VOAmwHTIbIFU.exe jGsuEZRybBNtn.exe oEEsRUAesSh.exe FAePapBU.exe amCGdOxej.exe OhUuhipAePER.exe XYYEof.exe eboO.exe PAinooOAyAAy.exe YiREai.exe nEaSY.exe eADtUtW.exe eeVU.exe JUcejA.exe EGWqscySDcUI.exe vEyHdcUDydY.exe sOMmIOJYGv.exe IFEu.exe ckVksJaC.exe refreshnerer27rb.info/6390mT6425wQ.mQP refreshnerer27.info/092BeEQKjH1.1pJ VYZKOAPIUs.exe AuPpHOsD.exe pEivEQbsFQY.exe YYwXcoikuaOO.exe eOOYafoYOoT.exe EixxZIko.exe wCuDyedy.exe cirtuOLy.exe UMIToiIOUs.exe fuseGStYznAI.exe SIfluuniIye.exe eRhyQTEFpo.exe OqfojpAvAWT.exe refreshnerer108.info/s8mBu2NYw3vl.pw1 refreshnerer108rb.info/1e555cy4d04.BEk uyDlwcdHEed.exe iJEJsiE.exe UHFWoqEXaeI.exe refreshnerer27.info/C55K9vLps5.Kls refreshnerer27rb.info/y72703z1Qv.Q3v aekmGlouAz.exe refreshnerer108.info/MeFL9K080.CGo refreshnerer108rb.info/u6af54jMx.nuO refreshnerer108.info/ZzOuBzg9RK.2q2 refreshnerer108rb.info/3gx1L2opk4mY.oUj aVAISpojY.exe wcpLYeuu.exe refreshnerer108.info/37y2XFzY40yg.88P refreshnerer108rb.info/d7xTIT19dny5.ucv touU.exe gImZitAeBy.exe refreshnerer108.info/7Lgn1UG0cZW.HA1 refreshnerer108rb.info/MuNsv2t2JaJS.dbM refreshnerer108.info/M3tH1I2zUXx.gGf refreshnerer108rb.info/23VnkXxH.373 cifcourse.info/3167.ace /q MHyGKgMenfy.exe ylaAjAOAO.exe refreshnerer27.info/WTgfUW03.10W AeoUi.exe QuMMMaf.exe oyizUNoXk.exe kaheANOIoHjL.exe PIAdSetiRTuO.exe yaOqAI.exe EyIaMEYAeE.exe YoayLjeeWmA.exe vEkkYXJuIID.exe refreshnerer108.info/3ye1C99mz.s07 refreshnerer108rb.info/eLo3NclpcLMb.8K1 avIEmIudy.exe IoUIOeu.exe EeEPOEX.exe NhFula.exe LJxYHE.exe AECSObEuAoN.exe ZyeZe.exe UOEXFURmyAYe.exe yjUo.exe ieeUIryaqObOY.exe steepexpressway.info/kawfuwfsloox.zey steepexpressway.info/07uulquv2m79.iii ww3away.info/4alljihrar3q.oho ww3away.info/haetpgwofgja.voi steepexpressway.info/07uulquv2m79.ohc OyMkiEUAuUSUw.exe ehASUOoaE.exe CaUEIXhkU.exe anwaUUoeUZX.exe kboY.exe steepexpressway.info/ftznjrztoald.iwp steepexpressway.info/rkozsjmvms0s.xph steepexpressway.info/rkozsjmvms0s.pys ARbb.exe refreshnerer27rb.info/A97XTHtAO9P4.eiK refreshnerer27.info/101P1c0bxm42.1t2 YEIyo.exe lImoAOUxP.exe oAypioi.exe ytaYKuGOvOrOa.exe devground.info/mnuzlrvtkehh.krc devground.info/sond08pixd90.aal yeeaNhHluyy.exe NEaKqU.exe EFAUA.exe kNVARpjgXa.exe refreshnerer108rb.info/8Zc6gUd4BdL.SYn cwoIZD.exe refreshnerer108.info/Fq09BbjLvw.50l refreshnerer108rb.info/1UU08s5T.P3b AAyVIOYCUao.exe kgeYuEHb.exe refreshnerer108.info/C97qkeZT.K7u AIueCoylUa.exe insmartair.com/6fid76azhbjl.dab insmartair.com/cwwcnrbpftvp.sul UCuTfyAq.exe IOAAyrtivOM.exe hTIeeqduv.exe ijqyJma.exe OjGiw.exe premiumse.info/lwoaiivjdodo.toc premiumse.info/5gmdez6j67ee.qef zvIoH.exe YuiqQisikIId.exe refreshnerer108.info/ML2AMJiX03.m8Y ogpOYfjXG.exe LAtau.exe AIIolFnOxOj.exe MCeiyOd.exe giiYUFyZXiNM.exe YiEyEUIo.exe alaCigXyBdzwE.exe refreshnerer2208.info/5YODQshux.x4N refreshnerer2208rb.info/Zbm5EqI4.9y4 gAocYUkpoFD.exe yamUI.exe iaFnJLAdEu.exe mfuEOP.exe ycylUoMo.exe refreshnerer2208rb.info/xFL6775iE.PHB refreshnerer2208.info/il0Pz22i.zeC wUFkYSOUhIT.exe eoizkuuyYZOJI.exe iYazcAiAxiAWI.exe MFHoUiI.exe autaAiiEbOi.exe YciykTONS.exe EWLMOYy.exe YUoxXOyYUxzf.exe OujdIyU.exe iOQBVY.exe YIEy.exe refreshnerer1309rb.info/Z14OV9J5S52.D76 qELAV.exe ueuOYOexHnin.exe aYkOnaUYLoA.exe refreshnerer1309rb.info/uH2m9G6W8X.V8r refreshnerer1309.info/QEYu7ydq.P36 refreshnerer27rb.info/6M7m582HYR.bZI iIZOoOWuUkI.exe woHlUOyiaOX.exe HYaekIUEqE.exe refreshnerer27rb.info/Eaw4I14J.axA yAANYUieIe.exe yKURbMX.exe oeHQ.exe guWIOUUycbeCK.exe refreshnerer27.info/CZI70XnZ.lju QOprTEUuA.exe uYUvueiplUd.exe sumbersection.info/rtbvuguhysqr.ohf -q AOAoNYILG.exe yOHEGfeQvYujP.exe aUbOnhuyI.exe refreshnerer1309.info/5w4WOmBR.c61 rlbs.exe refreshnerer1309.info/f4z6Q797X77.64X fyWpiNH.exe BqflIgYRoW.exe EqahFdI.exe refreshnerer108rb.info/C76288EYt4.95y refreshnerer108rb.info/OqAdyn0w.9Q4 refreshnerer108.info/K3No9A0C39rF.718 yaoQDxidYobL.exe refreshnerer1309.info/67QaA5FEA6h7.93Q refreshnerer1309rb.info/W9iCHnHPs.2nE riIA.exe YjOJ.exe EEfUuIOYu.exe refreshnerer27.info/mka1uUTF.b9I dhOOOAi.exe uOaZn.exe refreshnerer2208rb.info/3D4h5q4JfP8I.Y4h IIwojeUa.exe OOQwl.exe EEAZOyKeL.exe XiEQ.exe UocVNuueY.exe yOpaCT.exe refreshnerer1309rb.info/79yeb35ky4.Qjj CoIyuIEWKPEJ.exe refreshnerer1309rb.info/Dzl6E58A3b.3KL refreshnerer1510.info/76tEViJt.H26 YaUf.exe BivHHEoJuoeu.exe eQCoNYzOiWO.exe WoeUiEgyAn.exe QOMOdve.exe refreshnerer1510.info/A4z4tdO7v71V.27E -q refreshnerer1510rb.info/8OBCJgn8q.8u6 freshrefreshnerer184.info/o4ndhg664.JHC EysAOaO.exe ugYiaiZiiLbSY.exe AYwosYiul.exe hbonAeWVpix.exe qyHIyYxZYCe.exe OyyunPWo.exe OIxkAIofbMvi.exe uiRyaXOP.exe HoioqwH.exe refreshnerer1309.info/pX7o0039.Q04 ylFrtiaA.exe aBTGcOWaAYn.exe aEifNWnuuOjY.exe refreshnerer1510rb.info/Y97TIxwak.pla /q refreshnerer1510.info/2a3Cz8yq8Qa.07d EXDyOhVVO.exe refreshnerer2208rb.info/h1m13Vbbwkg.A1E guardname.net/1w3uzqnb70t5.oil guardname.net/gekofvxtpfhh.dkk refreshnerer1510.info/NH8bY0MCS6Q.j79 refreshnerer1510rb.info/0eeFkn61J4.F6P RDLMA.exe

This hash has been seen with multiple file names. Alternate names can appear when software is updated, copied between folders, packed by an installer, or deliberately renamed to avoid recognition. Compare the exact MD5 above before assuming two names refer to the same file.

Geography:

52 observed countries
24.1%
10.0%
8.5%
8.2%
7.8%
4.4%
3.1%
2.9%
2.6%
2.0%
1.9%
1.7%
1.7%
1.3%
1.3%
1.3%
1.2%
1.0%
0.8%
0.8%
0.7%
0.7%
0.7%
0.7%
0.7%
0.7%
0.6%
0.6%
0.6%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.4%
0.4%
0.4%
0.4%
0.2%
0.2%
0.2%
0.2%
0.2%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%

The strongest geographic signal for this file is Russian Federation with 24.1% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 8.1 96.0%
Windows 10 4.0%

The most common operating system signal for RDLMA.exe is Windows 8.1 with 96.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

RDLMA.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x0000187a
Image base 0x00400000

PE Sections:

Sections 5
Raw data 54784

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 34304 bytes · 62.6% of section data
MD5 1b85baadfa4f5ec9b0116b11547220ba
.data 6144 bytes · 11.2% of section data
MD5 fd31e90b08cc9f6de0d5c3f116b2d61b
.idata 3584 bytes · 6.5% of section data
MD5 8bd52171a4917286e8403adefac9e81c
.rsrc 8192 bytes · 15.0% of section data
MD5 8578f6c0f122878f84c966a38d3a0d79
.reloc 2560 bytes · 4.7% of section data
MD5 84a0d7552b5714967c761fb9ff7f15a4

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

This file is still under review

ThreatInfo has not assigned a final verdict yet. Compare the file hash, location, signature, and publisher before trusting the file on a production system.

Scan with GridinSoft Anti-Malware Use a local scan if the file origin or behavior is unclear. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with e1d499c501dc2e1f8b451f1a43bfabed.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan if the source, path, or behavior looks unusual.