@MalwareTechBlog @SwiftOnSecurity not just local files either. Definitely been called for IR after cryptolocker hit their network shares.