Matt, Most likely the ransomware was delivered through opening a pdf from an email. The three cases I have worked on were delivered that way. jcj KK4VUS