home

tmp3c54.exe

CATALYST 13-1

ATI Technologies ULC

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from d2.driverscollection.com and multiple other hosts.
Publisher:
Advanced Micro Devices, Inc.  (signed by ATI Technologies ULC)

Product:
CATALYST 13-1

Description:
13-1_vista_win7_win8_64_dd_ccc_whql

Version:
0309

MD5:
cdac78e79d2895b0969d0b16e541b7d9

SHA-1:
4c27d7f7db3ccffbe46c231e344f6a3264e16541

SHA-256:
4122ce498af1bf1920975a7d41132fbbe4abedd43cba781bb93ec6cb213f5701

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/25/2024 4:28:43 AM UTC  (today)

File size:
146.5 MB (153,584,192 bytes)

Copyright:
Advanced Micro Devices, Inc.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\tmp3c54.exe

Digital Signature
Signed by:
ATI Technologies ULC

Authority:
VeriSign, Inc.

Valid from:
12/13/2011 1:00:00 AM

Valid to:
1/9/2015 12:59:59 AM

Subject:
CN=ATI Technologies ULC, OU=Product Deployment, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ATI Technologies ULC, L=Markham, S=Ontario, C=CA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
67E18A6937AE14C8BBB829BE916650FF

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:aL464mAVL75pwXr1I9drdlGEM4RpmWUzFi6aHLlYPsHs+AD13aNHJkqh:aLQ75po1I3r7+WUzs6aHLlYzDqHJkK

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file tmp3c54.exe has been seen being distributed by the following 12 URLs.

https://d2.driverscollection.com/1b015bd65ff4a25/1dacbb74f6f5a78313117505ba12efaf80f885506a3bb3985487062e914073f0fd0a11764e7de853414d4ab032b8c5f9581a4526/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

http://d2.driverscollection.com/45220964ce37f/f1384f64a56e20bbaf19ff9b7d1e2ad6136ff0ffc4925c1505dae6634c415d1cd1655c0c7839617a52a450898b899887534a2ba0/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driverscollection.com/2ec2dc9d7ebfcb/857a03365b7eafa4807272db9c96d423a95edd0fab04764d3dad5edcce6ae8f8edbc8d149693e1887b4128a8857de70657b32967/3/21/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driverscollection.com/4ad11cbbf8d1a/ab4058f0afb81a9320919864d97b817715992326e5df9becf9340c194046f4b05e384b6f77d664ca153de44ebf337a3d578d296f/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driver.ru/2ec2dca19ec305/2ef4006422c1ce3da060bac7f927197fbb9886b975c6ee3482bc2afe7234313bc3d2c803069a371b02fdc443eaac5df9567fe6d9/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

http://download.driverscollection.com/11ab2131be1/e09f0e8744a98b84a57fac43946cdabc5435f0fe7eb6ebf8a61cae0650fffd84632ae91739f87c0fea0232332d845c38516fc8fb/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driverscollection.com/6e856ec53b5d/f4c936a458f05cc943d9f64750e46835d7eb00ca75b62ed8d6f2b11bfa7cffa5f5a226d7886ede9832880309aaac242955f7b22a/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driverscollection.com/1b015b9aae2da46/747c82c8325d8995c7523b7eac4fe37437a71dfca3b3fcd40f24ba11663c7d0562fff7b89c80908db432c9032a5ae392565ae6de/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

https://d2.driverscollection.com/1d3f791a3fa0051/d3be6ec1a355884d0ad6baa1ef477ed6d75267417ad536f00747a96b2ff6eabe87856d8d9064de91aaeffd09e2986a67564e7a13/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

http://download.driverscollection.com/2b355f6a2c56be/82338af162aa89c82c78df88f7aa7b13a568a3bd2d03fd616d3bc8c7acff99318e23f174209c0302ebcb4fe2d09718e751196a5b/3/21/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

http://download.driverscollection.com/1b015b7d58eeefd/4043a979824d1da2b7f43749055daff217d4ea76f6d7496c9b4b3b2d19bc7cbf956d502e895aa623a7d8a84e29a8b10b5266ec35/3/15/1/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

http://www2.ati.com/.../13-1_vista_win7_win8_64_dd_ccc_whql.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.