After what seems a human-directed ransomware attack, I am analyzing the system. It is a Windows Server 2016 and I had created the usual Administrator account. Now I see that during the attack, a new "Administrador.WIN-RSDLE3HIAER" account has appeared under C:\Users folder. The old plain Administrator still exists but it seems like all files are now under the newly created account (Donwloads, favorites, Desktop, etc... are still in the original account, but empty). It is like the profile was moved to the new Account.
My question, in the search of learning is why is this done, why creating a new account? Is this some kind of self-protection from the attackers? Why is all my original content now under the newly created account? I could still enter "Administrator" under the login page and access my profile so this is why I cannot understand the nature of the new account/folder, how I got redirected... in a word... how does this thing work?