home

smss.exe

ToxicProcess

Tera information Technology co.Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘winsxstf’.
Publisher:
Tera information Technology co.Ltd  (signed and verified)

Product:
ToxicProcess

Version:
1.00

MD5:
5b18a9010478b7def447e37097d4defb

SHA-1:
e7532b0649f5e56f2005770b553ed9e84b87c0bb

SHA-256:
383187a4b8f789f1e9f74ece993d2a5a03472717455ba8ef4ff7ba17725c380d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 5:38:38 AM UTC  (today)

File size:
154.7 KB (158,376 bytes)

Product version:
1.00

Original file name:
tfProcess.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\toxicfree\smss.exe

Digital Signature
Signed by:
Tera information Technology co.Ltd

Authority:
Thawte, Inc.

Valid from:
12/13/2013 9:00:00 AM

Valid to:
1/13/2015 8:59:59 AM

Subject:
CN=Tera information Technology co.Ltd, O=Tera information Technology co.Ltd, L=Pohang-si, S=Gyeongsangbuk-do, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
28377EF971054177D82C4AEB0DC16F3A

File PE Metadata
Compilation timestamp:
7/19/2014 2:25:36 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x2B38

Entry point:
68, C0, 32, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, E4, 64, B8, 2C, CF, 84, F7, 48, 9D, 9A, B6, 9C, DD, 98, DF, 9D, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 50, 72, 6F, 6A, 65, 63, 74, 00, 00, 00, 00, 00, FF, CC, 31, 00, 05, 20, 50, 02, 37, 06, F1, 4D, 45, B5, 8E, 12, DF, 22, 85, E5, DF, 5B, 61, 67, 46, ED, 5F, 80, 4E, A6, 27, 8C, 46, 98, 9E, EF, 97, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00, AA, 00, 60, D3, 93, 00, 00, 00...
 
[+]

Entropy:
5.1823

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
136 KB (139,264 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
winsxstf

Command:
C:\Program Files\toxicfree\smss.exe


Scan smss.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.