home

tsatmim.exe

台新網路ATM即時通

InfoThink Technology Co., LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘tsatmim’.
Publisher:
InfoThink Technology CO., LTD.  (signed by InfoThink Technology Co., LTD.)

Product:
台新網路ATM即時通

Version:
3, 1, 0, 0

MD5:
68d287a87d65c9304b7bd39b38a23629

SHA-1:
d02d1150c0aa5a0bca96e1aeeabd10cb3f16a6a9

SHA-256:
cd86246f442aa19a2485124620b1a6df96c05e15ed3877b08c71731757be40d8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/27/2024 2:38:37 AM UTC  (today)

File size:
1.1 MB (1,113,064 bytes)

Product version:
3, 1, 0, 0

Copyright:
Copyright (c) InfoThink. 2003 - 2012

Original file name:
tsatmim.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\taishin\atmmessenger\tsatmim.exe

Digital Signature
Signed by:
InfoThink Technology Co., LTD.

Authority:
The USERTRUST Network

Valid from:
3/1/2010 8:00:00 AM

Valid to:
3/1/2013 7:59:59 AM

Subject:
CN="InfoThink Technology Co., LTD.", OU=I-TRAVEL, O="InfoThink Technology Co., LTD.", STREET="7F-1., No.510, Sec. 5, Zhongxiao E. Rd., Xinyi District, Taipei City 11083, Taiwan(R.O.C.)", L=Taipei City, S=N/A, PostalCode=11077, C=TW

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
3BEC7876BCF6990F13377EF2588A9C10

File PE Metadata
Compilation timestamp:
5/21/2012 5:54:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:/ZL5YCnADzo4hf9VKBb5BKhQDm3KxmNXyVEEQYTe3+/m9bmzGWWKF2QUaf2J70:fa/b4GWd2hh+

Entry address:
0x735DF

Entry point:
E8, 5B, C5, 00, 00, E9, 16, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 70, 4B, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 70, 4B, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B...
 
[+]

Entropy:
6.8344

Code size:
584 KB (598,016 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
tsatmim

Command:
C:\Program Files\taishin\atmmessenger\tsatmim.exe


Scan tsatmim.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.