PSNATCH Tracking File Creation at %APPDATA%\SmartUploader

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.