local-lightning.log (209.3 KB)
here is the log file. the ‘ransomware attack’ occurred on Tuesday morning, February 9th around 10:30am.
(quick update - I found the application residing in a subfolder in a canon utilities application folder. it had to exist somewhere, but have no idea how it installed in this location)