8fde0adfd3bc76c0716413206b684e62d646af71ad6c68cd18f51de6182402d8

Analysis

max time kernel
150s
max time network
77s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
02/10/2023, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

the river.bat
Size

763B
MD5

53b07578b2361f358fc7c72840d26e90
SHA1

b9beee1b2033bff76096ecb0ac649d1fdebf515a
SHA256

8fde0adfd3bc76c0716413206b684e62d646af71ad6c68cd18f51de6182402d8
SHA512

bf8e38cfdd7bc527e98f14afdfecca2e69bca2e2444e33769ecdb77e1dfccfc747faaf5cbbc30ff2ea2ff565296bc2d7d698807b2e916ff4a73d36d825fce54d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4536	3504	cmd.exe	72
PID 3504 wrote to memory of 4536	3504	cmd.exe	72
PID 3504 wrote to memory of 612	3504	cmd.exe	73
PID 3504 wrote to memory of 612	3504	cmd.exe	73
PID 3504 wrote to memory of 1812	3504	cmd.exe	74
PID 3504 wrote to memory of 1812	3504	cmd.exe	74
PID 3504 wrote to memory of 1112	3504	cmd.exe	75
PID 3504 wrote to memory of 1112	3504	cmd.exe	75
PID 3504 wrote to memory of 4428	3504	cmd.exe	76
PID 3504 wrote to memory of 4428	3504	cmd.exe	76
PID 3504 wrote to memory of 4240	3504	cmd.exe	77
PID 3504 wrote to memory of 4240	3504	cmd.exe	77
PID 3504 wrote to memory of 368	3504	cmd.exe	78
PID 3504 wrote to memory of 368	3504	cmd.exe	78
PID 3504 wrote to memory of 3840	3504	cmd.exe	79
PID 3504 wrote to memory of 3840	3504	cmd.exe	79
PID 3504 wrote to memory of 4732	3504	cmd.exe	80
PID 3504 wrote to memory of 4732	3504	cmd.exe	80
PID 3504 wrote to memory of 4952	3504	cmd.exe	81
PID 3504 wrote to memory of 4952	3504	cmd.exe	81
PID 3504 wrote to memory of 2648	3504	cmd.exe	82
PID 3504 wrote to memory of 2648	3504	cmd.exe	82
PID 3504 wrote to memory of 676	3504	cmd.exe	83
PID 3504 wrote to memory of 676	3504	cmd.exe	83
PID 3504 wrote to memory of 4960	3504	cmd.exe	84
PID 3504 wrote to memory of 4960	3504	cmd.exe	84
PID 3504 wrote to memory of 2768	3504	cmd.exe	85
PID 3504 wrote to memory of 2768	3504	cmd.exe	85
PID 3504 wrote to memory of 4880	3504	cmd.exe	86
PID 3504 wrote to memory of 4880	3504	cmd.exe	86
PID 3504 wrote to memory of 4680	3504	cmd.exe	87
PID 3504 wrote to memory of 4680	3504	cmd.exe	87
PID 3504 wrote to memory of 1388	3504	cmd.exe	88
PID 3504 wrote to memory of 1388	3504	cmd.exe	88
PID 3504 wrote to memory of 604	3504	cmd.exe	89
PID 3504 wrote to memory of 604	3504	cmd.exe	89
PID 3504 wrote to memory of 2456	3504	cmd.exe	90
PID 3504 wrote to memory of 2456	3504	cmd.exe	90
PID 3504 wrote to memory of 3944	3504	cmd.exe	91
PID 3504 wrote to memory of 3944	3504	cmd.exe	91
PID 3504 wrote to memory of 4988	3504	cmd.exe	92
PID 3504 wrote to memory of 4988	3504	cmd.exe	92
PID 3504 wrote to memory of 4852	3504	cmd.exe	93
PID 3504 wrote to memory of 4852	3504	cmd.exe	93
PID 3504 wrote to memory of 4460	3504	cmd.exe	94
PID 3504 wrote to memory of 4460	3504	cmd.exe	94
PID 3504 wrote to memory of 1188	3504	cmd.exe	95
PID 3504 wrote to memory of 1188	3504	cmd.exe	95
PID 3504 wrote to memory of 4964	3504	cmd.exe	96
PID 3504 wrote to memory of 4964	3504	cmd.exe	96
PID 3504 wrote to memory of 3084	3504	cmd.exe	97
PID 3504 wrote to memory of 3084	3504	cmd.exe	97
PID 3504 wrote to memory of 5020	3504	cmd.exe	98
PID 3504 wrote to memory of 5020	3504	cmd.exe	98
PID 3504 wrote to memory of 4204	3504	cmd.exe	99
PID 3504 wrote to memory of 4204	3504	cmd.exe	99
PID 3504 wrote to memory of 2216	3504	cmd.exe	100
PID 3504 wrote to memory of 2216	3504	cmd.exe	100
PID 3504 wrote to memory of 1384	3504	cmd.exe	101
PID 3504 wrote to memory of 1384	3504	cmd.exe	101
PID 3504 wrote to memory of 3332	3504	cmd.exe	102
PID 3504 wrote to memory of 3332	3504	cmd.exe	102
PID 3504 wrote to memory of 2160	3504	cmd.exe	103
PID 3504 wrote to memory of 2160	3504	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\the river.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4536
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:612
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1812
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1112
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4428
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4240
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:368
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3840
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4732
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4952
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2648
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:676
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2768
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1388
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:604
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2456
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3944
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4988
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4852
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4460
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5020
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4204
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2216
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1384
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3332
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2160
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1748
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:836
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3748
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3004
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4936
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4676
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3452
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3312
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1580
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3060
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4920
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4452
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3508
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2992
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5016
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4112
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4516
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3700
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3904
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4296
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4892
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2800
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:5000
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5072
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5068
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2080
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5080
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4924
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2964
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2192
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3992
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2100
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5012
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4216
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4784
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2124
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2200
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:356
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1860
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:820
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4976
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3744
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1680
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4228
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:5064
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3384
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3416
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3960
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2972
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4360
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1324
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1144
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2700
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4248
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:440
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4972
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4328
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4056
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4864
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3580
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:220
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1612
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3276
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:312
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:200
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3808
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3800
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4816
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4012
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2648
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:676
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2768
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1388
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:604
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2456
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3944
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4988
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4852
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4460
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4436
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4432
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4492
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2204
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3284
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:660
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:808
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4940
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4744
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4540
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4980
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4992
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4584
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3064
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1412
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2696
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4740
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4808
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3404
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4400
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4456
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4144
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4192
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3056
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3644
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3680
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4220
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4576
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4868
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4336
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4944
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:424
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3216
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4468
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4928
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2772
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1836
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4888
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2228
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:620
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3656
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4200
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3672
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:8
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4876
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:668
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1920
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3628
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4912
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5100
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3044
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1780
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3036
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2300
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3392
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3412
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:832
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1596
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2568
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1356
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1328
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4376
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4356
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2692
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4332
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2632
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2212
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5028
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4040
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4000
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:696
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3340
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2636
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4108
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:216
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3804
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:212
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3964
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4388
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3220
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1576
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4012
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2648
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:676
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2768
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1388
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:604
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2456
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3944
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4988
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4852
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4460
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4436
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3728
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4432
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2132
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2160
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4844
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:836
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3748
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3004
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4936
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4676
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4140
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4532
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1580
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3060
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2304
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2584
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4176
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2992
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5016
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4112
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3704
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2828
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:396
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3904
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4312
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4300
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2096
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5004
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5072
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3500
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2224
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1688
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:5080
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1720
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4324
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:68
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4304
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2904
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4896
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4696
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:936
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4464
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:512
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2112
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:720
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4976
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5104
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2600
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2296
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3164
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4132
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:956
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1596
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1336
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1332
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2896
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1192
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1380
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4224
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2452
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3604
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2176
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4032
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3456
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3224
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4536
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:612
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1612
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:196
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:208
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4240
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:368
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3564
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4792
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4164
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4628
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3008
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1604
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:524
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4700
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2656
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3236
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3980
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4860
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4412
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3264
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4856
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4396
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2916
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4984
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4496
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5020
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:428
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2216
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2180
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4036
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2204
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1748
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1896
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:808
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3784
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4744
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4540
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2852
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4624
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4584
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3064
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1412
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2696
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4772
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4452
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4008
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4400
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4720
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4192
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3056
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3680
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4872
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3896
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4868
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2800
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3128
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:5000
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3216
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4468
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:812
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2152
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1836
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1720
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2228
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2100
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5012
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4200
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3672
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2124
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2200
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2032
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1920
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4912
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:5100
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1684
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4168
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5064
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3392
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3412
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2972
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4360
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1356
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1328
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:344
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2692
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4248
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1512
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:5028
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4056
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4000
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4864
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:220
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1812
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3276
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:312
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3804
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:212
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3800
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4816
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4968
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1576
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4760
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3812
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:676
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:540
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1388
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:604
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4804
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3944
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1000
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3956
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4460
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4448
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4436
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1384
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3332
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:436
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:508
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4844
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1896
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1232
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4992
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4936
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3312
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4948
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4752
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1580
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4956
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4772
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2584
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4524
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2992
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3640
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4112
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3700
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2828
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:396
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3904
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4208
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4300
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5092
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5004
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3388
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2764
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4924
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2076
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2192
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3976
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4324
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3656
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4304
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4076
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4896
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1376
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:936
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2888
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3628
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2112
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4912
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1780
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4228
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2600
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4364
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3164
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3024
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2968
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:956
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1344
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1336
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3208
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2688
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4500
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2692
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1380
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:440
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2452
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4048
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4172
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4032
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3456
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3224
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4536
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1112
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1612
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:196
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:208
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4240
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:368
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4952
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4764
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:928
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4484
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:884
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1604
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2768
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1824
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2264
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3236
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3980
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5008
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4756
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3264
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3732
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4396
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1168
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4496
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5020
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2184
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2164
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2180
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4036
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:660
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4148
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:508
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4508
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3784
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4744
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4540
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4812
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4800
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4584
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3064
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4740
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4808
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3404
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4548
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4008
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4400
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4720
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3644
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3704
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3680
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4892
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4336
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4944
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:424
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3128
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5000
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3216
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4468
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2964
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2152
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2076
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:620
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3772
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4216
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2904
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:8
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4696
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:668
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1860
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2888
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1920
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4116
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3044
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1680
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1684
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4168
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3416
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3960
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3412
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1324
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1144
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1356
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4356
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2700
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4248
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4040
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5028
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4056
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3340
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2636
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:220
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1812
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:200
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:312
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3804
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4732
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3800
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4816
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4012
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2648
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4760
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:664
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:676
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2656
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4860
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1524
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4988
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3944
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4736
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3956
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4460
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4448
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4436
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4900
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3332
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4196
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:836
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4844
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1896
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3004
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4992
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4936
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4532
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4948
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4752
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2304
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4452
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4772
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3048
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4524
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2992
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4916
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4112
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4576
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2828
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:396
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1864
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2096
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4300
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5072
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3500
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2224
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5080
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4580
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1836
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2660
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3976
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4908
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5012
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4304
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4876
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4896
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4464
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:820
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:936
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3628
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2112
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1816
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:5044
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4228
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:996
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:832
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4028
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1260
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1596
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1152
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1344
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1336
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1192
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2688
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4244
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2692
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1380
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:440
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2176
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4048
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3580
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:520
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4236
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:612
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4536
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3276
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1228
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:196
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:208
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4240
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4792
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4164
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4764
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:928
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:608
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:884
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4700
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2768
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1824
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2208
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3236
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3980
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5008
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4756
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3696
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4748
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4984
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:880
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2676
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4496
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2216
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1872
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3284
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2180
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4036
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:660
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4148
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:508
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4508
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3784
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2852
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4540
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4812
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3256
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4920
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3060
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3508
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4808
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3404
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4548
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4008
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4516
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3056
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4220
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4296
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4872
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3680
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4892
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2800
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:5068
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2080
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4928
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2772
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3216
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4888
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2964
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2152
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2228
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:620
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3772
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4200
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2904
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:8
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2200
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:668
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4320
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2888
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2644
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5100
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3036
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2300
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1684
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3416
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3392
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3960
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3412
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2968
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1324
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1332
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2896
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4356
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2700
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4500
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3604
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4040
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4172
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4056
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3340
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3224
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:220
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1812
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:200
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3840
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3804
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4732
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:368
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4952
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4628
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3008
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4760
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3568
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1604
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2656
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2264
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4680
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4412
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4904
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4856
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3264
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4736
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4396
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1168
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:428
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:5020
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4436
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4900
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2204
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4196
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:836
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:5112
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4980
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3004
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4624
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4992
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4936
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4584
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3064
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4740
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2304
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4456
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4144
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3048
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4524
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3640
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4916
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3644
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2828
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4868
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1864
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2096
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4300
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3128
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3500
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2224
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5080
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1688
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1836
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2076
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2100
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3656
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5012
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3672
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4876
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4896
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2032
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:820
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:936
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3628
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2112
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3044
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1680
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3384
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:5064
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:996
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:832
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4028
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3024
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1328
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1344
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1336
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1192
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2688
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4244
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4328
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1512
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4560
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2176
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4884
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3580
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:520
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:216
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2636
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4536
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3276
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1612
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:196
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4004
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3220
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:368
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1576
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4012
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:928
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4484
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:884
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1604
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2088
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1824
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4880
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4804
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4860
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1000
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4904
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3696
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4204
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4748
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:880
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4964
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4432
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3084
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1872
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2164
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3332
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4036
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:660
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4148
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:508
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4508
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4676
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3004
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4996
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4800
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4920
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4948
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4752
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4808
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4456
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4548
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4008
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4400
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4212
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4312
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4576
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3896
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:396
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2800
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:5004
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:5068
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4928
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2772
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:812
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4888
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2964
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2152
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2660
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:620
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3772
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4200
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4304
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3672
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4696
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:668
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4320
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2888
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:1920
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4116
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1816
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2300
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1684
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4228
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4168
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3416
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3996
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1260
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:1596
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:1324
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:344
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:2896
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4356
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:2700
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3604
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4864
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4172
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4056
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3844
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:3808
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3964
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:1812
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3564
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3840
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:3804
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4816
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1108
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:3812
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:4628
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:3008
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:540
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:756
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:3568
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4960
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:604
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:2264
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4852
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:4412
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:4756
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:4856
- C:\Windows\system32\msg.exe
  msg * Don't worry, just rerun the file.
  2⤵
  PID:3956
- C:\Windows\system32\msg.exe
  msg * Why did we target you?
  2⤵
  PID:4492
- C:\Windows\system32\msg.exe
  msg * Because you're a retard!
  2⤵
  PID:4396
- C:\Windows\system32\msg.exe
  msg * If you are seeing this message.
  2⤵
  PID:1188
- C:\Windows\system32\msg.exe
  msg * Your files are gone!
  2⤵
  PID:1384
- C:\Windows\system32\msg.exe
  msg * If u closed the ransom windo....
  2⤵
  PID:428

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads