» rlls64.dll
Overview
Analysis
File Details

rlls64.dll

RelevantKnowledge

TMRG, Inc.

The component is part of the TMRG platform which will track various behaviors of web browsing habits including tracking sites and domains visited as well as ads clicked. The module rlls64.dll by TMRG has been detected as adware by 27 anti-malware scanners. Part of RelevantKnowledge, a program typically installed via a software bundle (with the user's knowledge should they read the EULA) and will run in the background collecting and monitoring information about the user's behavior in order to build an extensive profile.

File name:

rlls64.dll

Publisher:

TMRG, Inc. (signed and verified)

Product:

RelevantKnowledge

Version:

1.0.2.0 (Build 2.0)

MD5:

439486a95ba885aa0326b814c1e46dfe

SHA-1:

1cbb5ecaa630415d4cd8d7fd2564c61eca57100d

Scanner detections:

27 / 68

Status:

Adware

Analysis date:

4/26/2024 7:22:53 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Relevant.AZ

375

Avira AntiVirus

Adware/Relevant.K

7.11.113.240

avast!

Win32:Relevant-G

2014.9-160125

AVG

RelevantKnowledge

2017.0.2853

Bitdefender

Adware.Relevant.AZ

1.0.20.125

Bkav FE

W32.Clod8c1.Trojan

1.3.0.4562

Boost by Reason

Optional.TMRG

188838

Clam AntiVirus

PUA.RelevantKnowledge

0.98/18155

Comodo Security

UnclassifiedMalware

17625

Dr.Web

Adware.OSSProxy

9.0.1.025

Emsisoft Anti-Malware

Adware.Relevant.AZ

8.16.01.25.03

ESET NOD32

Win64/Adware.RK

10.6317

F-Prot

W64/MalwareF.GNGK

v6.4.7.1.166

F-Secure

Adware.Relevant.AZ

11.2016-25-01_2

G Data

Adware.Relevant.AZ

16.1.24

IKARUS anti.virus

not-a-virus:WebToolbar.Win64

t3scan.1.8.3.0

Kaspersky

not-a-virus:WebToolbar.Win64.RK

14.0.0.762

Malwarebytes

PUP.Adware.RelevantKnowledge

v2016.01.25.03

MicroWorld eScan

Adware.Relevant.AZ

17.0.0.75

NANO AntiVirus

Trojan.Win64.OSSProxy.gwdfj

0.28.6.62995

Norman

AdSpy.U

11.20160125

nProtect

Adware.Relevant.AZ

14.11.06.01

Reason Heuristics

PUP.TMRG (M)

16.1.25.15

Sophos

Generic Proxy-OSS Application

4.94

SUPERAntiSpyware

Spyware.RelevantKnowledge

9364

VIPRE Antivirus

Adware.Win32.RelevantKnowledge.a

23450

ViRobot

Adware.Relevant.736384

2011.4.7.4223

File size:

721.1 KB (738,432 bytes)

Product version:

1.0.2.0 (Build 2.0)

File type:

Dynamic link library (Win64 DLL)

Language:

English (United States)

Common path:

C:\Program Files\relevantknowledge\rlls64.dll

Digital Signature

Signed by:

TMRG, Inc.

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

9/1/2009 7:00:00 PM

Valid to:

9/27/2011 6:59:59 PM

Subject:

CN="TMRG, Inc.", OU=SECURE APPLICATION DEVELOPMENT, O="TMRG, Inc.", L=Reston, S=Virginia, C=US

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

0C22D897C820001A2C4C01D3AEBB98E8

File PE Metadata

Compilation timestamp:

9/28/2010 4:41:39 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:Zz65m4jsu0qnTlN8I8/Sb/8WJ6uo+Efi4WaGi/wE84ZVjwQs:Zd4jsu0qnTlN8I8aQWJdo+0rWaGuv4

Entry address:

0x61934

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 23, 8B, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, 40, 53, 48, 83, EC, 20, 45, 8B, 18, 48, 8B, DA, 4C, 8B, C9, 41, 83, E3, F8, 41, F6, 00, 04, 4C, 8B, D1, 74, 13, 41, 8B, 40, 08, 4D, 63, 50, 04, F7, D8, 4C, 03, D1, 48, 63, C8, 4C, 23, D1, 49, 63, C3, 4A, 8B, 14, 10, 48, 8B, 43, 10, 8B, 48, 08, 48, 03, 4B... 
[+]

Entropy:

6.1814

Code size:

505 KB (517,120 bytes)

Remove rlls64.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.