0
0

[–] ObeyTheFist ago 

System doesn't go out and start interrogating network shares like that. And Malware can coopt local system services.

0
0

[–] 2308672? [S] ago 

No malware was found, this showed up https://slimgur.com/image/B6o when I pulled the NAS network cable.

It clearly demonstrated that Windows itself was scanning my NAS drive. And this is an official paid Windows 10 pro version! No free upgrade or home edition.

0
0

[–] ObeyTheFist ago 

It clearly demonstrated that Windows itself was scanning my NAS drive.

If I borrow your car and run someone over, it doesn't mean you committed the crime even though it sure looked like your car at the crime scene. System service could be prompted to do this work by some malware or other unexpected or unwelcome process. It's best not to rule that out of the diagnosis at this stage.

There's a sysinternals tool called "Filemon" which you should probably run, it may shed some more light on what's actually happening here, which files are being accessed on your NAS and why.

You mention also that you don't have any mapped drives from your NAS... what about SMB shares being accessed by the UNC path? Have you configured any software to connect to those shares?