NoEscape wiper marker file created at C:\user.png

Subhankar H@Andrewsec57

•updated Jul 20, 2026•0•0•4

Detects the creation of a 'C:\user.png' file, which is known to be used as a marker file by NoEscape ransomware/wiper malware at the root of the system drive.