cryptostalker
cryptostalker copied to clipboard
Incorrectly alert on image files
trafficstars
I'm running a daemonized stalker on a fileserver.
It has triggered an alert for 2 image files:
$ file .../image2.JPG
.../image2.JPG: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1511x1095, frames 3
$ file .../CachedImage_1920_1080_POS4.jpg
.../CachedImage_1920_1080_POS4.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3
Mind throwing these images into an attachment?
Looks like this is happening, when Windows roaming profiles are being written to file server during client logout/shutdown. I'll check if these files are still there and attach them if so.
Folder: .../profiles/$USERNAME.V2/AppData/Roaming/Microsoft/Windows/Themes/CachedFiles/CachedImage_1920_1080_POS4.jpg
Looks like an background image to me ;)
