home

tsatmim.exe

台新網路ATM即時通

InfoThink Technology Co., LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘tsatmim’.
Publisher:
InfoThink Technology CO., LTD.  (signed by InfoThink Technology Co., LTD.)

Product:
台新網路ATM即時通

Version:
3, 1, 3, 0

MD5:
0300f505029fa8f7fa904022b087a624

SHA-1:
e26bce86fafc3c8e6cd4a9c22c483e2347e278ca

SHA-256:
0b847db7686e40ebe64e1fcd4d060ec2af8032b2e86911353dd0f4239057922e

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/6/2024 12:43:55 AM UTC  (today)

File size:
1.1 MB (1,111,608 bytes)

Product version:
3, 1, 3, 0

Copyright:
Copyright (c) InfoThink. 2003 - 2015

Original file name:
tsatmim.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\taishin\atmmessenger\tsatmim.exe

Digital Signature
Signed by:
InfoThink Technology Co., LTD.

Authority:
COMODO CA Limited

Valid from:
3/5/2013 8:00:00 AM

Valid to:
3/5/2016 7:59:59 AM

Subject:
CN="InfoThink Technology Co., LTD.", OU=I-TRAVEL, O="InfoThink Technology Co., LTD.", STREET="7F-1., No.510, Sec. 5, Zhongxiao E. Rd., Xinyi District, Taipei City 11083, Taiwan(R.O.C.)", L=Taipei City, S=Taipei, PostalCode=11077, C=TW

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
756DA513E4C4AA0E05AACBB13CFAEB33

File PE Metadata
Compilation timestamp:
6/26/2015 5:44:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x72818

Entry point:
E8, 42, C5, 00, 00, E9, 16, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 54, 60, 4B, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 54, 60, 4B, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B...
 
[+]

Entropy:
6.8394

Code size:
580 KB (593,920 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
tsatmim

Command:
C:\Program Files\taishin\atmmessenger\tsatmim.exe


Scan tsatmim.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.