GridinSoft Threat Intelligence

atikmdag.sys threat report

Detected as Trojan.Generic File reputation report
MD5 048c310f865c762d76ce807f9d022cea
Latest seen 2025-06-12 23:00:57 (11 months ago)
First seen 2025-06-12 23:00:57 (11 months ago)
Size 20 MB
Publisher Advanced Micro Devices, Inc.
Product ATI Radeon Family

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2025-06-12 23:00:57 (11 months ago)
File hash
048c310f865c762d76ce807f9d022cea
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic.

Timeline

First seen 2025-06-12 23:00:57 (11 months ago); latest analysis 2025-06-12 23:00:57 (11 months ago).

Publisher context

Company metadata: Advanced Micro Devices, Inc.. Product metadata: ATI Radeon Family.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

File context

atikmdag.sys is a Windows file recorded in the ThreatInfo database. It is associated with ATI Radeon Family. The reported company name is Advanced Micro Devices, Inc.. The current detection status is Trojan.Generic, based on the latest analysis from 2025-06-12 23:00:57 (11 months ago).

If atikmdag.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: ATI Radeon Family
Company Name: Advanced Micro Devices, Inc.
MD5: 048c310f865c762d76ce807f9d022cea
Size: 20 MB
First Published: 2025-06-12 23:00:57 (11 months ago)
Latest Published: 2025-06-12 23:00:57 (11 months ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2025-06-12 23:00:57 (11 months ago)

Detection screenshot

atikmdag.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%system%\driverstore\filerepository\c0180730.inf_amd64_5f9cf4cab41b6065
%sysdrive%\windows.old\windows\system32\driverstore\filerepository\c0180730.inf_amd64_5f9cf4cab41b6065
%windir%\lastgood.tmp\system32

ThreatInfo has observed atikmdag.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen atikmdag.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Philippines
Share 100.0%
Low High activity

The strongest geographic signal for this file is Philippines with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for atikmdag.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

atikmdag.sys is identified as pe for 64-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 64-bit
Subsystem Native
Entry point 0x00002050
Image base 0x0000000000010000

PE Sections:

Sections 54
Raw data 21074944

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 2058240 bytes · 9.8% of section data
MD5 4c368fa8bc8e30e19d2d229b1cb6fc93
_wtext 512 bytes · 0.0% of section data
Uncommon name
MD5 f01283c6d3c08fa7afb01c4f511a4b0e
.rdata 1313792 bytes · 6.2% of section data
MD5 31edffbc25a5c742b512753d2525213e
.data 6326272 bytes · 30.0% of section data
Large raw data
MD5 f0810f0e8940bfc9c4435468cc3c5d8d
.pdata 330752 bytes · 1.6% of section data
MD5 c4dfef5192e991c259dad297197b15e5
.gfids 512 bytes · 0.0% of section data
Uncommon name
MD5 b8f05a0df5ed2474ce52e7452dae18ac
PAGE_COM 488960 bytes · 2.3% of section data
Uncommon name
MD5 e7862d4b8a86938f6a012a7a1dcc5815
PAGE_CAI 270336 bytes · 1.3% of section data
Uncommon name
MD5 21d278c8fb4e9541a8dcf090166803af
PAGE_DAL 1921024 bytes · 9.1% of section data
Uncommon name
MD5 b23345a8e14114f98ab52f6d2d1f049f
PAGE_ISR 17408 bytes · 0.1% of section data
Uncommon name
MD5 04231a04905cfc17bcfe60db1fa8d5d0
PAGEDC40 1024 bytes · 0.0% of section data
Uncommon name
MD5 8863b5a69101b2a50eb77707e87ffc22
PAGEDC50 1024 bytes · 0.0% of section data
Uncommon name
MD5 b72e046afdf5a09a960f50d5d46b59cb
PAGEDC60 1536 bytes · 0.0% of section data
Uncommon name
MD5 ffb9ceee744da6d057e7f7a28cbb63de
PAGEDC80 512 bytes · 0.0% of section data
Uncommon name
MD5 c04e4835e58eac7631c1e4f944e79a73
PAGEDC10 512 bytes · 0.0% of section data
Uncommon name
MD5 6fca05508bdd193f94fd89c7328eeb64
PAGEDC11 45056 bytes · 0.2% of section data
Uncommon name
MD5 fb7051c673615891439884878e22fc45
PAGEDC11 512 bytes · 0.0% of section data
Uncommon name
MD5 410982c7f577d0c7461ed4aec6e13c7a
PAGE_PPL 774144 bytes · 3.7% of section data
Uncommon name
MD5 a19d3bba988a5db77f85af4f70f68315
PAGE_CPC 158208 bytes · 0.8% of section data
Uncommon name
MD5 a7232f4a37f90d297b75f462cb0be08f
PAGE 7680 bytes · 0.0% of section data
Uncommon name
MD5 3064d3869776eb4afb0de8f7ef10a026
PAGE_CAI 2232832 bytes · 10.6% of section data
Uncommon name
MD5 26204f312e61c1c291e6c163266ca852
PAGE 3401728 bytes · 16.1% of section data
Uncommon name
MD5 268dbe2e5a7794402fbf09170d2a2955
PAGE_IEG 34816 bytes · 0.2% of section data
Uncommon name
MD5 04775439ed76c516f0cb281556ee134e
PAGE_ILN 18432 bytes · 0.1% of section data
Uncommon name
MD5 7b63af9b370bf4f2d23946c180eab608
PAGE_IBT 31744 bytes · 0.2% of section data
Uncommon name
MD5 a91f5e090897d8698d240a933facef0e
PAGE_INI 34304 bytes · 0.2% of section data
Uncommon name
MD5 b43f7faa16603efaeec43f0505c1710f
PAGE_ITN 24576 bytes · 0.1% of section data
Uncommon name
MD5 771b3619a1c78ef87083ac032aad6e9a
PAGE_ISI 34304 bytes · 0.2% of section data
Uncommon name
MD5 845c3df230e5bb4c63a5641f03afdf89
PAGE_ICI 38400 bytes · 0.2% of section data
Uncommon name
MD5 d3aa44fea7736cf2aac0495ba7130a01
PAGE_IKV 35840 bytes · 0.2% of section data
Uncommon name
MD5 97e65da146783c15b534e8c4e7cf544c
PAGE_IIL 16896 bytes · 0.1% of section data
Uncommon name
MD5 12ce854d24582b22ae312aa5fb23a3ea
PAGE_IVI 41472 bytes · 0.2% of section data
Uncommon name
MD5 53fe6d6ac68f298427e18eb567e209a3
PAGE_ICZ 40448 bytes · 0.2% of section data
Uncommon name
MD5 dadb69e3c483a2534fd4228e472bad0c
PAGE_RO 323584 bytes · 1.5% of section data
Uncommon name
MD5 0495756012e7a47f780afeaea9f59e86
PAGE_RW 689664 bytes · 3.3% of section data
Uncommon name
MD5 a4d05358fbea15c755f7e1dfb1b0dce0
PAGE_ISR 7680 bytes · 0.0% of section data
Uncommon name
MD5 ec2eaf71c6a2bbf45aaea32fa229b514
PAGE_ISR 512 bytes · 0.0% of section data
Uncommon name
MD5 86e98f0e9d8be82ea83a262ec61ba3c7
PAGEDC40 512 bytes · 0.0% of section data
Uncommon name
MD5 e28171dde7eb088a3cbaa7176440ba06
PAGEDC40 512 bytes · 0.0% of section data
Uncommon name
MD5 c25d4b311ffa2211d638bacb212536af
PAGEDC50 512 bytes · 0.0% of section data
Uncommon name
MD5 992b53d4475b32ef2a5d671e5d78ec90
PAGEDC50 512 bytes · 0.0% of section data
Uncommon name
MD5 06553f7d198910f1a909bd9cf27459a9
PAGEDC60 512 bytes · 0.0% of section data
Uncommon name
MD5 aad86e6efa274707c62f87284c117a27
PAGEDC60 512 bytes · 0.0% of section data
Uncommon name
MD5 cb02b23e56eab75c1d090fc0d8827550
PAGEDC80 512 bytes · 0.0% of section data
Uncommon name
MD5 ac95ac403319b0d10ad6f5d4a0fc79a8
PAGEDC80 512 bytes · 0.0% of section data
Uncommon name
MD5 3c3db67534c46e451f4c9091540c6b25
PAGEDC10 512 bytes · 0.0% of section data
Uncommon name
MD5 36f07b19dc2f0163d0f08ce5d96c4b70
PAGEDC10 512 bytes · 0.0% of section data
Uncommon name
MD5 463d19e602c27e882e1dd2469c1329d7
PAGEDC11 6656 bytes · 0.0% of section data
Uncommon name
MD5 cc0ced05fced2be3cd4457644970efd6
PAGEDC11 512 bytes · 0.0% of section data
Uncommon name
MD5 6c57c35bb7cbe8bee6adc45fef9173cf
PAGEDC11 512 bytes · 0.0% of section data
Uncommon name
MD5 191ab590bc07d9cef9dcfab2d72e92e3
PAGE_CPR 32256 bytes · 0.2% of section data
Uncommon name
MD5 e09cbfb14acb2a1186de027335bda301
INIT 6144 bytes · 0.0% of section data
Uncommon name
MD5 c865e712ba39ebc795f5d7b7cad0bb16
.rsrc 2560 bytes · 0.0% of section data
MD5 33a6c80a7a93f5deaa294fed3e638a21
.reloc 295936 bytes · 1.4% of section data
MD5 d074a3183ffec81a93a9f98bb83bd7de

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies atikmdag.sys by MD5 048c310f865c762d76ce807f9d022cea. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 048c310f865c762d76ce807f9d022cea.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found.