cryptostalker icon indicating copy to clipboard operation
cryptostalker copied to clipboard

Incorrectly alert on image files

Open morph027 opened this issue 8 years ago • 3 comments
trafficstars

I'm running a daemonized stalker on a fileserver.

It has triggered an alert for 2 image files:

$ file .../image2.JPG
.../image2.JPG: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1511x1095, frames 3
$ file .../CachedImage_1920_1080_POS4.jpg
.../CachedImage_1920_1080_POS4.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3

morph027 avatar Dec 15 '16 11:12 morph027

Mind throwing these images into an attachment?

unixist avatar Jan 07 '17 20:01 unixist

Looks like this is happening, when Windows roaming profiles are being written to file server during client logout/shutdown. I'll check if these files are still there and attach them if so.

morph027 avatar Jan 09 '17 17:01 morph027

Folder: .../profiles/$USERNAME.V2/AppData/Roaming/Microsoft/Windows/Themes/CachedFiles/CachedImage_1920_1080_POS4.jpg

Looks like an background image to me ;)

cachedimage_1920_1080_pos4

morph027 avatar Jan 15 '17 08:01 morph027