1) Right after midnight, the attackers connected to a machine on the targeted network most probably via RDP. 3) The attacker used psexec.exe to execute “Cobalt.Client.exe”, which is the Pay2Key ransomware itself, on different machines within the organization