CrypVault

Ransomware family which makes encrypted files look like they have been quarantined by AV.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Adds policy Run key to start application

Executes dropped EXE