Function Name
FlushEfsCache
Description
FlushEfsCache is used to flush EFS data from memory. This is used by EFS ransomware post-encryption to cause the files and folder to become unreadable.
Library
Advapi32.dll
Associated Attacks
Ransomware
Documentation
https://www.geoffchappell.com/studies/windows/win32/advapi32/api/index.htm
Created: 2021-11-01
Last Update: 2021-11-01
Credits: mr.d0x