home

smss.exe

ToxicProcess

Tera information Technology co.Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘winsxstf’.
Publisher:
Tera information Technology co.Ltd  (signed and verified)

Product:
ToxicProcess

Version:
1.00

MD5:
8f5f48d3dec79e3926cdd4749fa81cc9

SHA-1:
5fff9b97e63d722e1b70da050319389ccf0569cd

SHA-256:
f7952e105de1f0004e51f63218089dca3c9e2651ecca4bddbc66c56f184b6ecb

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/16/2024 11:22:47 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
BACKDOOR.Trojan
9.0.1.0249

File size:
154.7 KB (158,376 bytes)

Product version:
1.00

Original file name:
tfProcess.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\toxicfree\smss.exe

Digital Signature
Signed by:
Tera information Technology co.Ltd

Authority:
Thawte, Inc.

Valid from:
12/13/2013 9:00:00 AM

Valid to:
1/13/2015 8:59:59 AM

Subject:
CN=Tera information Technology co.Ltd, O=Tera information Technology co.Ltd, L=Pohang-si, S=Gyeongsangbuk-do, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
28377EF971054177D82C4AEB0DC16F3A

File PE Metadata
Compilation timestamp:
8/8/2014 7:54:32 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:m27KzwtMJf6b5yK5JIqYCFjdHsjaZuWJ0FxYrQ:m0/tMcYC/HsjquW6Ft

Entry address:
0x2B18

Entry point:
68, A0, 32, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, 40, 9B, F3, 3E, 19, D3, 11, 42, 95, 35, F5, 66, BD, B3, AB, 35, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 2D, 38, 42, 30, 32, 2D, 50, 72, 6F, 6A, 65, 63, 74, 00, 00, 00, 00, 00, FF, CC, 31, 00, 05, D8, EF, 02, 9F, B0, B2, DB, 4F, 9C, 49, 0C, 67, 28, 58, E8, F6, BF, E2, 00, F8, A8, 9B, 91, 46, 98, 00, 49, EE, 7B, A5, BE, C6, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00, AA, 00, 60, D3, 93, 00, 00, 00...
 
[+]

Entropy:
5.1824

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
136 KB (139,264 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
winsxstf

Command:
C:\Program Files\toxicfree\smss.exe


Scan smss.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.