home

itcurusr.exe

lsass.exe

LightStar Information Co.,Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘SmartIT Client’.
Publisher:
Light Star Information  (signed by LightStar Information Co.,Ltd.)

Product:
lsass.exe

Description:
SmartIT Client Current User

Version:
0, 0, 0, 48

MD5:
5318d211975f314e826976ec748c9b3d

SHA-1:
144e83e1eb11c77ea54a218736377f0bf326b8f6

SHA-256:
db628e29d0f2ddb6c0d5ede186d84e13fb5b2d058ec5a31b5e112745d0011277

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/5/2024 8:43:10 PM UTC  (today)

File size:
395.4 KB (404,888 bytes)

Product version:
8, 3, 16, 707

Copyright:
Copyright (c) Light Star Information 2016

Original file name:
lsass.exe

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
LightStar Information Co.,Ltd.

Authority:
VeriSign, Inc.

Valid from:
4/22/2016 8:00:00 AM

Valid to:
2/11/2019 7:59:59 AM

Subject:
CN="LightStar Information Co.,Ltd.", O="LightStar Information Co.,Ltd.", L=New Taipei City, S=New Taipei City, C=TW

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4AD39B9CE421AAAE333BBDDD38D0D4E5

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x10D001

Entry point:
60, E8, 03, 00, 00, 00, E9, EB, 04, 5D, 45, 55, C3, E8, 01, 00, 00, 00, EB, 5D, BB, ED, FF, FF, FF, 03, DD, 81, EB, 00, D0, 10, 00, 83, BD, 22, 04, 00, 00, 00, 89, 9D, 22, 04, 00, 00, 0F, 85, 65, 03, 00, 00, 8D, 85, 2E, 04, 00, 00, 50, FF, 95, 4D, 0F, 00, 00, 89, 85, 26, 04, 00, 00, 8B, F8, 8D, 5D, 5E, 53, 50, FF, 95, 49, 0F, 00, 00, 89, 85, 4D, 05, 00, 00, 8D, 5D, 6B, 53, 57, FF, 95, 49, 0F, 00, 00, 89, 85, 51, 05, 00, 00, 8D, 45, 77, FF, E0, 56, 69, 72, 74, 75, 61, 6C, 41, 6C, 6C, 6F, 63, 00, 56, 69, 72...
 
[+]

Entropy:
7.9321

Packer / compiler:
ASPack v2.12

Code size:
883.5 KB (904,704 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SmartIT Client

Command:
"C:\smartit\itcurusr.exe" -fromlogin


Scan itcurusr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.