https://www.socinvestigation.com/windows-event-id-5379-to-detect-malicious-password-protected-file-unlock/