f4ea19586894a59719f462a9e481c53bd525746afa8b40fd0e6b4d1d7813cb54

Analysis

max time kernel
194s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.bat
Size

505B
MD5

a44e6c575c7543c2773978b8d7123b45
SHA1

2aa1ed3a24fe8c134f086c50d9d44cc9686194ff
SHA256

f4ea19586894a59719f462a9e481c53bd525746afa8b40fd0e6b4d1d7813cb54
SHA512

af8805ebbd389cd2e3c16e4554bbccd29cedd3b44db069d624da5aa4ad9bcba4653cd5faac600e0121df7f1d0feee04d95f9b908776c69b63726a43cb05162b5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 64 IoCs

ransomware

pid	Process
744	NOTEPAD.EXE
5200	NOTEPAD.EXE
12240	NOTEPAD.EXE
13564	NOTEPAD.EXE
14448	NOTEPAD.EXE
5456	NOTEPAD.EXE
6808	NOTEPAD.EXE
6380	NOTEPAD.EXE
14092	NOTEPAD.EXE
15756	NOTEPAD.EXE
8596	NOTEPAD.EXE
10540	NOTEPAD.EXE
12448	NOTEPAD.EXE
14632	NOTEPAD.EXE
6680	NOTEPAD.EXE
6456	NOTEPAD.EXE
12996	NOTEPAD.EXE
7652	NOTEPAD.EXE
9260	NOTEPAD.EXE
7744	NOTEPAD.EXE
10192	NOTEPAD.EXE
13760	NOTEPAD.EXE
14144	NOTEPAD.EXE
15708	NOTEPAD.EXE
2972	NOTEPAD.EXE
7444	NOTEPAD.EXE
11572	NOTEPAD.EXE
7172	NOTEPAD.EXE
7656	NOTEPAD.EXE
8624	NOTEPAD.EXE
10800	NOTEPAD.EXE
11204	NOTEPAD.EXE
8128	NOTEPAD.EXE
15804	NOTEPAD.EXE
6404	NOTEPAD.EXE
11352	NOTEPAD.EXE
11556	NOTEPAD.EXE
12704	NOTEPAD.EXE
3052	NOTEPAD.EXE
6548	NOTEPAD.EXE
11072	NOTEPAD.EXE
13044	NOTEPAD.EXE
1620	NOTEPAD.EXE
1996	NOTEPAD.EXE
13220	NOTEPAD.EXE
14696	NOTEPAD.EXE
10972	NOTEPAD.EXE
9372	NOTEPAD.EXE
10136	NOTEPAD.EXE
6640	NOTEPAD.EXE
12100	NOTEPAD.EXE
16208	NOTEPAD.EXE
4992	NOTEPAD.EXE
5052	NOTEPAD.EXE
4300	NOTEPAD.EXE
8000	NOTEPAD.EXE
4332	NOTEPAD.EXE
9244	NOTEPAD.EXE
14788	NOTEPAD.EXE
8484	NOTEPAD.EXE
9484	NOTEPAD.EXE
13896	NOTEPAD.EXE
13444	NOTEPAD.EXE
14536	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1596	1184	cmd.exe	85
PID 1184 wrote to memory of 1596	1184	cmd.exe	85
PID 1184 wrote to memory of 4992	1184	cmd.exe	86
PID 1184 wrote to memory of 4992	1184	cmd.exe	86
PID 1184 wrote to memory of 624	1184	cmd.exe	87
PID 1184 wrote to memory of 624	1184	cmd.exe	87
PID 1184 wrote to memory of 3608	1184	cmd.exe	88
PID 1184 wrote to memory of 3608	1184	cmd.exe	88
PID 1184 wrote to memory of 5096	1184	cmd.exe	89
PID 1184 wrote to memory of 5096	1184	cmd.exe	89
PID 1184 wrote to memory of 1620	1184	cmd.exe	90
PID 1184 wrote to memory of 1620	1184	cmd.exe	90
PID 1184 wrote to memory of 2544	1184	cmd.exe	91
PID 1184 wrote to memory of 2544	1184	cmd.exe	91
PID 1184 wrote to memory of 4736	1184	cmd.exe	92
PID 1184 wrote to memory of 4736	1184	cmd.exe	92
PID 1184 wrote to memory of 1228	1184	cmd.exe	93
PID 1184 wrote to memory of 1228	1184	cmd.exe	93
PID 1184 wrote to memory of 1876	1184	cmd.exe	94
PID 1184 wrote to memory of 1876	1184	cmd.exe	94
PID 1184 wrote to memory of 3692	1184	cmd.exe	95
PID 1184 wrote to memory of 3692	1184	cmd.exe	95
PID 1184 wrote to memory of 4816	1184	cmd.exe	97
PID 1184 wrote to memory of 4816	1184	cmd.exe	97
PID 1184 wrote to memory of 4576	1184	cmd.exe	98
PID 1184 wrote to memory of 4576	1184	cmd.exe	98
PID 1184 wrote to memory of 4788	1184	cmd.exe	99
PID 1184 wrote to memory of 4788	1184	cmd.exe	99
PID 1184 wrote to memory of 1640	1184	cmd.exe	100
PID 1184 wrote to memory of 1640	1184	cmd.exe	100
PID 1184 wrote to memory of 4892	1184	cmd.exe	101
PID 1184 wrote to memory of 4892	1184	cmd.exe	101
PID 1184 wrote to memory of 3340	1184	cmd.exe	102
PID 1184 wrote to memory of 3340	1184	cmd.exe	102
PID 1184 wrote to memory of 2576	1184	cmd.exe	103
PID 1184 wrote to memory of 2576	1184	cmd.exe	103
PID 1184 wrote to memory of 3052	1184	cmd.exe	104
PID 1184 wrote to memory of 3052	1184	cmd.exe	104
PID 1184 wrote to memory of 3752	1184	cmd.exe	105
PID 1184 wrote to memory of 3752	1184	cmd.exe	105
PID 1184 wrote to memory of 5052	1184	cmd.exe	106
PID 1184 wrote to memory of 5052	1184	cmd.exe	106
PID 1184 wrote to memory of 4100	1184	cmd.exe	107
PID 1184 wrote to memory of 4100	1184	cmd.exe	107
PID 1184 wrote to memory of 3672	1184	cmd.exe	108
PID 1184 wrote to memory of 3672	1184	cmd.exe	108
PID 1184 wrote to memory of 456	1184	cmd.exe	109
PID 1184 wrote to memory of 456	1184	cmd.exe	109
PID 1184 wrote to memory of 3668	1184	cmd.exe	110
PID 1184 wrote to memory of 3668	1184	cmd.exe	110
PID 1184 wrote to memory of 2172	1184	cmd.exe	111
PID 1184 wrote to memory of 2172	1184	cmd.exe	111
PID 1184 wrote to memory of 2616	1184	cmd.exe	112
PID 1184 wrote to memory of 2616	1184	cmd.exe	112
PID 1184 wrote to memory of 1192	1184	cmd.exe	113
PID 1184 wrote to memory of 1192	1184	cmd.exe	113
PID 1184 wrote to memory of 452	1184	cmd.exe	114
PID 1184 wrote to memory of 452	1184	cmd.exe	114
PID 1184 wrote to memory of 468	1184	cmd.exe	115
PID 1184 wrote to memory of 468	1184	cmd.exe	115
PID 1184 wrote to memory of 1252	1184	cmd.exe	116
PID 1184 wrote to memory of 1252	1184	cmd.exe	116
PID 1184 wrote to memory of 5020	1184	cmd.exe	117
PID 1184 wrote to memory of 5020	1184	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX1.txt
  2⤵
  PID:1596
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX2.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4992
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX3.txt
  2⤵
  PID:624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX4.txt
  2⤵
  PID:3608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX5.txt
  2⤵
  PID:5096
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX6.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX7.txt
  2⤵
  PID:2544
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX8.txt
  2⤵
  PID:4736
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX9.txt
  2⤵
  PID:1228
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX10.txt
  2⤵
  PID:1876
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX11.txt
  2⤵
  PID:3692
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX12.txt
  2⤵
  PID:4816
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX13.txt
  2⤵
  PID:4576
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX14.txt
  2⤵
  PID:4788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX15.txt
  2⤵
  PID:1640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX16.txt
  2⤵
  PID:4892
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX17.txt
  2⤵
  PID:3340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX18.txt
  2⤵
  PID:2576
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX19.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX20.txt
  2⤵
  PID:3752
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX21.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX22.txt
  2⤵
  PID:4100
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX23.txt
  2⤵
  PID:3672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX24.txt
  2⤵
  PID:456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX25.txt
  2⤵
  PID:3668
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX26.txt
  2⤵
  PID:2172
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX27.txt
  2⤵
  PID:2616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX28.txt
  2⤵
  PID:1192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX29.txt
  2⤵
  PID:452
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX30.txt
  2⤵
  PID:468
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX31.txt
  2⤵
  PID:1252
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX32.txt
  2⤵
  PID:5020
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX33.txt
  2⤵
  PID:760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX34.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX35.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4300
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX36.txt
  2⤵
  PID:3204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX37.txt
  2⤵
  PID:332
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX38.txt
  2⤵
  PID:804
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX39.txt
  2⤵
  PID:1572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX40.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:744
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX41.txt
  2⤵
  PID:1608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX42.txt
  2⤵
  PID:1796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX43.txt
  2⤵
  PID:3884
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX44.txt
  2⤵
  PID:3976
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX45.txt
  2⤵
  PID:2292
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX46.txt
  2⤵
  PID:2380
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX47.txt
  2⤵
  PID:1992
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX48.txt
  2⤵
  PID:232
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX49.txt
  2⤵
  PID:5016
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX50.txt
  2⤵
  PID:3656
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX51.txt
  2⤵
  PID:924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX52.txt
  2⤵
  PID:5036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX53.txt
  2⤵
  PID:3756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX54.txt
  2⤵
  PID:3184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX55.txt
  2⤵
  PID:5168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX56.txt
  2⤵
  PID:5224
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX57.txt
  2⤵
  PID:5260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX58.txt
  2⤵
  PID:5304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX59.txt
  2⤵
  PID:5344
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX60.txt
  2⤵
  PID:5404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX61.txt
  2⤵
  PID:5440
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX62.txt
  2⤵
  PID:5496
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX63.txt
  2⤵
  PID:5540
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX64.txt
  2⤵
  PID:5568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX65.txt
  2⤵
  PID:5624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX66.txt
  2⤵
  PID:5652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX67.txt
  2⤵
  PID:5688
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX68.txt
  2⤵
  PID:5740
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX69.txt
  2⤵
  PID:5796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX70.txt
  2⤵
  PID:5828
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX71.txt
  2⤵
  PID:5868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX72.txt
  2⤵
  PID:5904
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX73.txt
  2⤵
  PID:5964
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX74.txt
  2⤵
  PID:6000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX75.txt
  2⤵
  PID:6036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX76.txt
  2⤵
  PID:6088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX77.txt
  2⤵
  PID:6120
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX78.txt
  2⤵
  PID:5156
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX79.txt
  2⤵
  PID:5296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX80.txt
  2⤵
  PID:5412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX81.txt
  2⤵
  PID:5520
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX82.txt
  2⤵
  PID:5632
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX83.txt
  2⤵
  PID:5772
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX84.txt
  2⤵
  PID:5884
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX85.txt
  2⤵
  PID:6024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX86.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX87.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX88.txt
  2⤵
  PID:5988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX89.txt
  2⤵
  PID:5316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX90.txt
  2⤵
  PID:6168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX91.txt
  2⤵
  PID:6204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX92.txt
  2⤵
  PID:6232
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX93.txt
  2⤵
  PID:6268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX94.txt
  2⤵
  PID:6332
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX95.txt
  2⤵
  PID:6368
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX96.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX97.txt
  2⤵
  PID:6444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX98.txt
  2⤵
  PID:6488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX99.txt
  2⤵
  PID:6532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX100.txt
  2⤵
  PID:6568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX101.txt
  2⤵
  PID:6608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX102.txt
  2⤵
  PID:6648
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX103.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6680
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX104.txt
  2⤵
  PID:6724
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX105.txt
  2⤵
  PID:6764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX106.txt
  2⤵
  PID:6824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX107.txt
  2⤵
  PID:6868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX108.txt
  2⤵
  PID:6908
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX109.txt
  2⤵
  PID:6940
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX110.txt
  2⤵
  PID:6972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX111.txt
  2⤵
  PID:7024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX112.txt
  2⤵
  PID:7064
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX113.txt
  2⤵
  PID:7116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX114.txt
  2⤵
  PID:7148
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX115.txt
  2⤵
  PID:6192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX116.txt
  2⤵
  PID:6320
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX117.txt
  2⤵
  PID:6472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX118.txt
  2⤵
  PID:6604
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX119.txt
  2⤵
  PID:6744
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX120.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX121.txt
  2⤵
  PID:7052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX122.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6808
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX123.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6548
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX124.txt
  2⤵
  PID:7112
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX125.txt
  2⤵
  PID:6700
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX126.txt
  2⤵
  PID:7200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX127.txt
  2⤵
  PID:7228
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX128.txt
  2⤵
  PID:7272
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX129.txt
  2⤵
  PID:7308
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX130.txt
  2⤵
  PID:7364
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX131.txt
  2⤵
  PID:7392
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX132.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX133.txt
  2⤵
  PID:7488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX134.txt
  2⤵
  PID:7536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX135.txt
  2⤵
  PID:7564
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX136.txt
  2⤵
  PID:7592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX137.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7656
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX138.txt
  2⤵
  PID:7684
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX139.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7744
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX140.txt
  2⤵
  PID:7772
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX141.txt
  2⤵
  PID:7832
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX142.txt
  2⤵
  PID:7872
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX143.txt
  2⤵
  PID:7904
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX144.txt
  2⤵
  PID:7940
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX145.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX146.txt
  2⤵
  PID:8032
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX147.txt
  2⤵
  PID:8068
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX148.txt
  2⤵
  PID:8100
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX149.txt
  2⤵
  PID:8148
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX150.txt
  2⤵
  PID:6564
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX151.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4332
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX152.txt
  2⤵
  PID:7408
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX153.txt
  2⤵
  PID:7620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX154.txt
  2⤵
  PID:7764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX155.txt
  2⤵
  PID:7880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX156.txt
  2⤵
  PID:7936
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX157.txt
  2⤵
  PID:8052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX158.txt
  2⤵
  PID:8136
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX159.txt
  2⤵
  PID:7576
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX160.txt
  2⤵
  PID:64
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX161.txt
  2⤵
  PID:7196
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX162.txt
  2⤵
  PID:7932
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX163.txt
  2⤵
  PID:8220
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX164.txt
  2⤵
  PID:8264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX165.txt
  2⤵
  PID:8312
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX166.txt
  2⤵
  PID:8340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX167.txt
  2⤵
  PID:8388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX168.txt
  2⤵
  PID:8420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX169.txt
  2⤵
  PID:8444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX170.txt
  2⤵
  PID:8496
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX171.txt
  2⤵
  PID:8548
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX172.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8596
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX173.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX174.txt
  2⤵
  PID:8660
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX175.txt
  2⤵
  PID:8748
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX176.txt
  2⤵
  PID:8792
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX177.txt
  2⤵
  PID:8824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX178.txt
  2⤵
  PID:8864
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX179.txt
  2⤵
  PID:8892
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX180.txt
  2⤵
  PID:8960
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX181.txt
  2⤵
  PID:9008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX182.txt
  2⤵
  PID:9080
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX183.txt
  2⤵
  PID:9124
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX184.txt
  2⤵
  PID:8204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX185.txt
  2⤵
  PID:2436
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX186.txt
  2⤵
  PID:8472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX187.txt
  2⤵
  PID:8652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX188.txt
  2⤵
  PID:8808
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX189.txt
  2⤵
  PID:4304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX190.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX191.txt
  2⤵
  PID:8244
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX192.txt
  2⤵
  PID:4404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX193.txt
  2⤵
  PID:9076
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX194.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8484
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX195.txt
  2⤵
  PID:9224
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX196.txt
  2⤵
  PID:9276
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX197.txt
  2⤵
  PID:9316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX198.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9372
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX199.txt
  2⤵
  PID:9404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX200.txt
  2⤵
  PID:9456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX201.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9484
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX202.txt
  2⤵
  PID:9532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX203.txt
  2⤵
  PID:9568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX204.txt
  2⤵
  PID:9612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX205.txt
  2⤵
  PID:9664
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX206.txt
  2⤵
  PID:9704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX207.txt
  2⤵
  PID:9748
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX208.txt
  2⤵
  PID:9776
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX209.txt
  2⤵
  PID:9864
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX210.txt
  2⤵
  PID:9908
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX211.txt
  2⤵
  PID:9956
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX212.txt
  2⤵
  PID:9996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX213.txt
  2⤵
  PID:10040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX214.txt
  2⤵
  PID:10072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX215.txt
  2⤵
  PID:10120
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX216.txt
  2⤵
  PID:10160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX217.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX218.txt
  2⤵
  PID:2408
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX219.txt
  2⤵
  PID:9304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX220.txt
  2⤵
  PID:8716
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX221.txt
  2⤵
  PID:9452
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX222.txt
  2⤵
  PID:9552
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX223.txt
  2⤵
  PID:9700
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX224.txt
  2⤵
  PID:9860
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX225.txt
  2⤵
  PID:10016
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX226.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10136
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX227.txt
  2⤵
  PID:9844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX228.txt
  2⤵
  PID:8768
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX229.txt
  2⤵
  PID:10060
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX230.txt
  2⤵
  PID:8692
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX231.txt
  2⤵
  PID:9828
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX232.txt
  2⤵
  PID:9172
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX233.txt
  2⤵
  PID:10268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX234.txt
  2⤵
  PID:10296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX235.txt
  2⤵
  PID:10348
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX236.txt
  2⤵
  PID:10376
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX237.txt
  2⤵
  PID:10416
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX238.txt
  2⤵
  PID:10468
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX239.txt
  2⤵
  PID:10504
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX240.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10540
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX241.txt
  2⤵
  PID:10580
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX242.txt
  2⤵
  PID:10644
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX243.txt
  2⤵
  PID:10680
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX244.txt
  2⤵
  PID:10716
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX245.txt
  2⤵
  PID:10752
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX246.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX247.txt
  2⤵
  PID:10840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX248.txt
  2⤵
  PID:10872
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX249.txt
  2⤵
  PID:10920
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX250.txt
  2⤵
  PID:10964
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX251.txt
  2⤵
  PID:11024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX252.txt
  2⤵
  PID:11064
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX253.txt
  2⤵
  PID:11092
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX254.txt
  2⤵
  PID:11132
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX255.txt
  2⤵
  PID:11184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX256.txt
  2⤵
  PID:11216
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX257.txt
  2⤵
  PID:4076
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX258.txt
  2⤵
  PID:10500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX259.txt
  2⤵
  PID:10620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX260.txt
  2⤵
  PID:9044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX261.txt
  2⤵
  PID:10708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX262.txt
  2⤵
  PID:10852
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX263.txt
  2⤵
  PID:3192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX264.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:11072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX265.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:11204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX266.txt
  2⤵
  PID:11004
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX267.txt
  2⤵
  PID:10896
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX268.txt
  2⤵
  PID:11192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX269.txt
  2⤵
  PID:11128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX270.txt
  2⤵
  PID:11296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX271.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:11352
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX272.txt
  2⤵
  PID:11384
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX273.txt
  2⤵
  PID:11424
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX274.txt
  2⤵
  PID:11472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX275.txt
  2⤵
  PID:11512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX276.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:11556
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX277.txt
  2⤵
  PID:11596
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX278.txt
  2⤵
  PID:11636
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX279.txt
  2⤵
  PID:11680
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX280.txt
  2⤵
  PID:11708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX281.txt
  2⤵
  PID:11752
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX282.txt
  2⤵
  PID:11788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX283.txt
  2⤵
  PID:11832
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX284.txt
  2⤵
  PID:11876
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX285.txt
  2⤵
  PID:11916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX286.txt
  2⤵
  PID:11956
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX287.txt
  2⤵
  PID:11992
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX288.txt
  2⤵
  PID:12036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX289.txt
  2⤵
  PID:12088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX290.txt
  2⤵
  PID:12124
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX291.txt
  2⤵
  PID:12168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX292.txt
  2⤵
  PID:12208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX293.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:12240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX294.txt
  2⤵
  PID:12280
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX295.txt
  2⤵
  PID:11376
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX296.txt
  2⤵
  PID:10364
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX297.txt
  2⤵
  PID:11532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX298.txt
  2⤵
  PID:11592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX299.txt
  2⤵
  PID:11704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX300.txt
  2⤵
  PID:11908
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX301.txt
  2⤵
  PID:12020
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX302.txt
  2⤵
  PID:12152
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX303.txt
  2⤵
  PID:12260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX304.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:11572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX305.txt
  2⤵
  PID:11900
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX306.txt
  2⤵
  PID:3200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX307.txt
  2⤵
  PID:5092
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX308.txt
  2⤵
  PID:3256
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX309.txt
  2⤵
  PID:4664
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX310.txt
  2⤵
  PID:3488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX311.txt
  2⤵
  PID:2080
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX312.txt
  2⤵
  PID:4368
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX313.txt
  2⤵
  PID:4924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX314.txt
  2⤵
  PID:3468
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX315.txt
  2⤵
  PID:12316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX316.txt
  2⤵
  PID:12364
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX317.txt
  2⤵
  PID:12404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX318.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:12448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX319.txt
  2⤵
  PID:12492
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX320.txt
  2⤵
  PID:12540
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX321.txt
  2⤵
  PID:12568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX322.txt
  2⤵
  PID:12608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX323.txt
  2⤵
  PID:12652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX324.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:12704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX325.txt
  2⤵
  PID:12744
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX326.txt
  2⤵
  PID:12768
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX327.txt
  2⤵
  PID:12824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX328.txt
  2⤵
  PID:12856
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX329.txt
  2⤵
  PID:12896
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX330.txt
  2⤵
  PID:12940
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX331.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:12996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX332.txt
  2⤵
  PID:13036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX333.txt
  2⤵
  PID:13068
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX334.txt
  2⤵
  PID:13104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX335.txt
  2⤵
  PID:13148
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX336.txt
  2⤵
  PID:13200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX337.txt
  2⤵
  PID:13240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX338.txt
  2⤵
  PID:13268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX339.txt
  2⤵
  PID:4260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX340.txt
  2⤵
  PID:4360
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX341.txt
  2⤵
  PID:1676
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX342.txt
  2⤵
  PID:3640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX343.txt
  2⤵
  PID:1928
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX344.txt
  2⤵
  PID:12512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX345.txt
  2⤵
  PID:2564
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX346.txt
  2⤵
  PID:12600
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX347.txt
  2⤵
  PID:12632
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX348.txt
  2⤵
  PID:2452
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX349.txt
  2⤵
  PID:12720
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX350.txt
  2⤵
  PID:12764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX351.txt
  2⤵
  PID:5464
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX352.txt
  2⤵
  PID:5576
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX353.txt
  2⤵
  PID:5752
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX354.txt
  2⤵
  PID:3448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX355.txt
  2⤵
  PID:5976
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX356.txt
  2⤵
  PID:13024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX357.txt
  2⤵
  PID:5336
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX358.txt
  2⤵
  PID:13144
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX359.txt
  2⤵
  PID:5948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX360.txt
  2⤵
  PID:5756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX361.txt
  2⤵
  PID:12964
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX362.txt
  2⤵
  PID:6256
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX363.txt
  2⤵
  PID:6344
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX364.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6380
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX365.txt
  2⤵
  PID:6500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX366.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX367.txt
  2⤵
  PID:6760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX368.txt
  2⤵
  PID:6836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX369.txt
  2⤵
  PID:12880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX370.txt
  2⤵
  PID:5760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX371.txt
  2⤵
  PID:2000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX372.txt
  2⤵
  PID:6164
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX373.txt
  2⤵
  PID:13116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX374.txt
  2⤵
  PID:13264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX375.txt
  2⤵
  PID:6524
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX376.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7172
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX377.txt
  2⤵
  PID:7284
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX378.txt
  2⤵
  PID:4440
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX379.txt
  2⤵
  PID:13292
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX380.txt
  2⤵
  PID:6964
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX381.txt
  2⤵
  PID:5984
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX382.txt
  2⤵
  PID:7780
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX383.txt
  2⤵
  PID:13120
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX384.txt
  2⤵
  PID:6432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX385.txt
  2⤵
  PID:8096
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX386.txt
  2⤵
  PID:7572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX387.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13220
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX388.txt
  2⤵
  PID:7784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX389.txt
  2⤵
  PID:4644
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX390.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX391.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX392.txt
  2⤵
  PID:7928
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX393.txt
  2⤵
  PID:8328
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX394.txt
  2⤵
  PID:8412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX395.txt
  2⤵
  PID:5204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX396.txt
  2⤵
  PID:8616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX397.txt
  2⤵
  PID:13340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX398.txt
  2⤵
  PID:13400
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX399.txt
  2⤵
  PID:13428
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX400.txt
  2⤵
  PID:13472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX401.txt
  2⤵
  PID:13512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX402.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13564
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX403.txt
  2⤵
  PID:13596
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX404.txt
  2⤵
  PID:13644
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX405.txt
  2⤵
  PID:13688
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX406.txt
  2⤵
  PID:13728
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX407.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX408.txt
  2⤵
  PID:13800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX409.txt
  2⤵
  PID:13840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX410.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13896
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX411.txt
  2⤵
  PID:13924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX412.txt
  2⤵
  PID:13976
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX413.txt
  2⤵
  PID:14024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX414.txt
  2⤵
  PID:14064
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX415.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14092
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX416.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14144
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX417.txt
  2⤵
  PID:14192
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX418.txt
  2⤵
  PID:14232
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX419.txt
  2⤵
  PID:14268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX420.txt
  2⤵
  PID:14308
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX421.txt
  2⤵
  PID:8672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX422.txt
  2⤵
  PID:13396
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX423.txt
  2⤵
  PID:4672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX424.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX425.txt
  2⤵
  PID:13532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX426.txt
  2⤵
  PID:4456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX427.txt
  2⤵
  PID:2940
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX428.txt
  2⤵
  PID:13752
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX429.txt
  2⤵
  PID:2992
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX430.txt
  2⤵
  PID:8432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX431.txt
  2⤵
  PID:13972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX432.txt
  2⤵
  PID:9324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX433.txt
  2⤵
  PID:14088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX434.txt
  2⤵
  PID:12420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX435.txt
  2⤵
  PID:14204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX436.txt
  2⤵
  PID:9672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX437.txt
  2⤵
  PID:9892
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX438.txt
  2⤵
  PID:2404
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX439.txt
  2⤵
  PID:8820
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX440.txt
  2⤵
  PID:9560
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX441.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9244
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX442.txt
  2⤵
  PID:10176
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX443.txt
  2⤵
  PID:14316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX444.txt
  2⤵
  PID:6104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX445.txt
  2⤵
  PID:10276
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX446.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:9260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX447.txt
  2⤵
  PID:10432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX448.txt
  2⤵
  PID:8684
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX449.txt
  2⤵
  PID:14348
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX450.txt
  2⤵
  PID:14400
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX451.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX452.txt
  2⤵
  PID:14488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX453.txt
  2⤵
  PID:14512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX454.txt
  2⤵
  PID:14568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX455.txt
  2⤵
  PID:14616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX456.txt
  2⤵
  PID:14656
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX457.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14696
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX458.txt
  2⤵
  PID:14736
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX459.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX460.txt
  2⤵
  PID:14880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX461.txt
  2⤵
  PID:14924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX462.txt
  2⤵
  PID:14952
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX463.txt
  2⤵
  PID:15008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX464.txt
  2⤵
  PID:15036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX465.txt
  2⤵
  PID:15088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX466.txt
  2⤵
  PID:15116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX467.txt
  2⤵
  PID:15160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX468.txt
  2⤵
  PID:15212
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX469.txt
  2⤵
  PID:15240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX470.txt
  2⤵
  PID:15280
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX471.txt
  2⤵
  PID:15324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX472.txt
  2⤵
  PID:10560
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX473.txt
  2⤵
  PID:10768
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX474.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:10972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX475.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX476.txt
  2⤵
  PID:11032
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX477.txt
  2⤵
  PID:14692
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX478.txt
  2⤵
  PID:11200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX479.txt
  2⤵
  PID:10412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX480.txt
  2⤵
  PID:14948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX481.txt
  2⤵
  PID:15064
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX482.txt
  2⤵
  PID:15156
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX483.txt
  2⤵
  PID:11272
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX484.txt
  2⤵
  PID:15316
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX485.txt
  2⤵
  PID:11444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX486.txt
  2⤵
  PID:14468
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX487.txt
  2⤵
  PID:14500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX488.txt
  2⤵
  PID:2388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX489.txt
  2⤵
  PID:11776
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX490.txt
  2⤵
  PID:11840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX491.txt
  2⤵
  PID:11944
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX492.txt
  2⤵
  PID:12004
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX493.txt
  2⤵
  PID:13616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX494.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:12100
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX495.txt
  2⤵
  PID:12180
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX496.txt
  2⤵
  PID:12268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX497.txt
  2⤵
  PID:11720
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX498.txt
  2⤵
  PID:14824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX499.txt
  2⤵
  PID:10572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX500.txt
  2⤵
  PID:15144
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX501.txt
  2⤵
  PID:2844
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX502.txt
  2⤵
  PID:2372
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX503.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:14632
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX504.txt
  2⤵
  PID:2432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX505.txt
  2⤵
  PID:1708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX506.txt
  2⤵
  PID:11980
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX507.txt
  2⤵
  PID:3712
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX508.txt
  2⤵
  PID:448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX509.txt
  2⤵
  PID:12064
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX510.txt
  2⤵
  PID:12504
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX511.txt
  2⤵
  PID:12552
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX512.txt
  2⤵
  PID:3264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX513.txt
  2⤵
  PID:12664
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX514.txt
  2⤵
  PID:3008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX515.txt
  2⤵
  PID:12780
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX516.txt
  2⤵
  PID:12868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX517.txt
  2⤵
  PID:12988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX518.txt
  2⤵
  PID:1968
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX519.txt
  2⤵
  PID:15384
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX520.txt
  2⤵
  PID:15424
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX521.txt
  2⤵
  PID:15476
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX522.txt
  2⤵
  PID:15504
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX523.txt
  2⤵
  PID:15548
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX524.txt
  2⤵
  PID:15600
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX525.txt
  2⤵
  PID:15628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX526.txt
  2⤵
  PID:15668
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX527.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:15708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX528.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:15756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX529.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:15804
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX530.txt
  2⤵
  PID:15836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX531.txt
  2⤵
  PID:15872
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX532.txt
  2⤵
  PID:15912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX533.txt
  2⤵
  PID:15956
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX534.txt
  2⤵
  PID:16016
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX535.txt
  2⤵
  PID:16060
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX536.txt
  2⤵
  PID:16088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX537.txt
  2⤵
  PID:16128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX538.txt
  2⤵
  PID:16176
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX539.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:16208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX540.txt
  2⤵
  PID:16240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX541.txt
  2⤵
  PID:16304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX542.txt
  2⤵
  PID:16332
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX543.txt
  2⤵
  PID:16372
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX544.txt
  2⤵
  PID:1880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX545.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:13044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX546.txt
  2⤵
  PID:15516
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX547.txt
  2⤵
  PID:15580
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX548.txt
  2⤵
  PID:15624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX549.txt
  2⤵
  PID:13208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Nuked_by_SX550.txt
  2⤵
  PID:5936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Nuked_by_SX1.txt

Filesize
17B

MD5
0bfd2f90c076206ed8fb648ffa92b44e

SHA1
86b851a23f1a6559ef282c9d37157b0bf5436d31

SHA256
07a22c1ae9c201169d4f47f65fec780ca1391c6211cd49c032caa3a45b18672f

SHA512
dfb8303d547fa82014698a29b32a10d43e5a4b9375ca173c0eddfc1b8c796f3c85d9cfd8dc501608997035612978671ee93a1ca71f927e6427915c633af9c393

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX10.txt

Filesize
18B

MD5
ab6a4f21f97e85aaffd78f190791c221

SHA1
524b0210af19dff7c68b4be774db1441a1f7e1e4

SHA256
5c8b3aeef806acf672cfaf7eaba376cd0a1cab53b531f91c003836fb5d614199

SHA512
4bdd72030cae0325b77bd5795aafb5a51964788473c32579558c8c903d89247017f82e93221b2c8af79c35da7c540c1f3cf7e74c8308641a601f3163c769339d

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX11.txt

Filesize
18B

MD5
f0fb8a0bfc6ab9f6083cd148c46753fb

SHA1
077b8f8c61d8e406bdd7b2204c2bd8ebcc95f7eb

SHA256
19e51a1d5ff787b94f7da2c4bfe6adcd3ca8b0a9e34a8437350d39e2791f1773

SHA512
0206501a9144123870c8701eaccef26e5074189048a78d854d80ea1b4dd496f36cc7b13cf0f5a69ee3cf2d7fa26f7eeba06d6fcaf0095a7656edcd2181a915e8

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX12.txt

Filesize
18B

MD5
df706681b271994f194c7327710e8bac

SHA1
b156c3d82285611ca86b06551632bd34ec7350ef

SHA256
790a5fbe4bee1a5d2608b101730553018d46960d7709fd7a4d78abc9aabb4e0d

SHA512
8cb5d48f5ccc3c90381ca89527bef90a1d145e9f7eb3e67209a460aba26b78cfd59860152a63a54ad2757704105481979b1c8241c1e6474a9153f238a87604c8

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX13.txt

Filesize
18B

MD5
0364c0e1f0bae7e3d22f92d22631374a

SHA1
52b05ecd399ebe72959d3cc9fecf368902b62b85

SHA256
f739bac74c6dacd831424d3d6a5de03a078d8e516b5d9f4185f6367f73fce9e6

SHA512
437e4d96f573a7a36c106c04b6900bcb21f5b0037a439a799e4b1613eb324875b9d92fca4cf0d38df6c19e0861dd3d65440d611d5748f1f63b03d42d405adc8c

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX14.txt

Filesize
18B

MD5
d176059ffde034494f3574184cc657da

SHA1
fc47e50cbcdad14b55eb10fb873b78553cda0a8f

SHA256
3bd9bff2b7022b77c052156cf1ec33b251fe1a2a27078bc2b819d5b4eb2e6470

SHA512
0f3aa99bad1da37ec5197eaadda13f74e6b03cdc434b34fd09c9e5414492ac00ceadd96930c291b2a24caebf0cd72e97ceda38d27d9fe786f3ffff9a2a414701

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX15.txt

Filesize
18B

MD5
b88c67aa5c493b4fe53c08eaf6ac61c0

SHA1
e05681c49f715d33d9665199c2058db0880a82b1

SHA256
083d19827bcdb0b17c34c4509c6a8245426d79de7f6002b28130354ee0161604

SHA512
2c54dd61b78c108e13cd48f1c9989a1d818bb6c60400b8e82008c2fb076e51f1f0a28305418e0ce2a4c52394767e6488193c4edacd55a07c3700425d7e4e4aa0

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX16.txt

Filesize
18B

MD5
f72fd45aeceb6f45de395730a2cb6b71

SHA1
6ac1f85cebf8d983312ec87026c7f681d89c463d

SHA256
acee14f32b0b448accf7acc4318d5832ec41fc22b677b8612bcf5300baecd78a

SHA512
bbd676a4fcd2f52b4e7774b3b875c9aab06b301197a1557aceca84cb6eb43f649cc2cc760ca65278704b5cb3bb0bdbb3c1e8c471781eedce37d05eee42677ae2

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX17.txt

Filesize
18B

MD5
8d89bbb41dda1d9c2a9b2bfac3349585

SHA1
3c6b4956a704c7320439d16a1b776a42b8399bf2

SHA256
b5a22a8e97d76bc637657ce695fab120dbfa32dc862bb0cf6d6f54eb1007e623

SHA512
339a5953da07e509f95a09a1060a74af361ad8fd6174a5c7805abc4b527ab215037e1dcbaaa031ba834e6b9fa8ba99b0877ad59faa580ec1795bbd0d6dcad81e

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX18.txt

Filesize
18B

MD5
9ed7fe55e89e4f1f8bfb73c5391d77d8

SHA1
f4c259153068197a09122adba529fc1f86df6fbe

SHA256
c7868b579b28010017a3d702dcd23ff22402acfb547b1a55963031b179e1e36b

SHA512
ac89e650b3180a8136ade75446417a6cafe1ca49b770edd3c72c3eab0376d286412a1be72213b164c143f37b1034d47f733be580ef7518240591907b28ae3119

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX19.txt

Filesize
18B

MD5
da59994eeb7ca9ef25a797e9bfaf637b

SHA1
214d26e80c043fe7511f9e4bcff8bc9850e50bed

SHA256
88f4011f5f6a08058c9d90e982ccc6e7393c408dfcf98b2a62bdcc6b48670ad5

SHA512
54689133b9c26bccfe3326b6ebdb1e5461c15a9264be0fb7e793b58e31fa7c9277fbcf2166778413d9d9f7779b731323ade2d986199147c34b5d8c2363b8c574

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX2.txt

Filesize
17B

MD5
0f085c2cead2fec0c94eb201e43a19a9

SHA1
f0d78ce7125fa73c62bd771a208c06103e52820d

SHA256
d41430830e9aaaf398f8cc52fcb80a8b960ef7f6b8694242a115b5b76f7bf4d0

SHA512
9c2b5e7736e27cd4f8be2c78b04c87b0e8e99bafc435b52835103a74970cb5d93ccc5cf1b30494a51a7408431ab800fd668878df76bea1e282fd0301024cdccf

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX20.txt

Filesize
18B

MD5
99954392bee47aa4f8e727b7140befbd

SHA1
b105d48f77318e2e2f9c93d851ad0566de505987

SHA256
da57eaf9eae60e6a1c0bc1452b4f10e350532871200f948f4d19753d64da5619

SHA512
3b7341cbce588c47bc9688ab1d09a9e3b83e6f72426bec0ee00c7daa085fcf30e5639b874233e5fda689f4856b237f453652323504d015ceec798e257e1473e6

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX21.txt

Filesize
18B

MD5
7c261d6eb8eb69ad5ec31a797b5f3eb9

SHA1
a4348671b2f3ddf456840bdc09df3a5a9dc27613

SHA256
23f7e27cf8334c6096c2eca86ef3241d91e904ea0431552b7a5ea59bfe1d97d1

SHA512
f9c61e5cd50c3142a08f07c941e964b5baf02adc5e9a38b3b032e6ecad2aab79bd666ac55a93e03b6c80623ecbea562ce95aba2ca58681bf64f19c07bd198eed

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX22.txt

Filesize
18B

MD5
8a8cf964a9300beee462ecc09dcc83c8

SHA1
987e56fb989c4f232f8582821d2ee9ca70ee7421

SHA256
b3176344118d5e95705bd877842cbb7afc0e679230c7434bbf4b834c3cb04691

SHA512
4f70173b27cefd616d1fb55214b192bd5a1bbf09760e93fe76f5d86af18abb3f6e0ebacde81685e05cea68e85426c2e073ee47501db4e5fec58cda4949cb8564

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX23.txt

Filesize
18B

MD5
c99f1247ffe3ad31e08e576097fb23fe

SHA1
74f7835aa08167e9a595aaafd51564b4fc487f76

SHA256
49874550d41a4a629769c0d640da7414693fc6f21e7b5e367cbcea67bc4cbecb

SHA512
b759f95531da994cb682e2deda9e5363cb8c9f987f51a0316664c8f0ab8d92290f0b2d0e974d41c5d91f7af375e98f1b7cf74fb5086413143dc32d62a710fa4b

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX24.txt

Filesize
18B

MD5
ea5639d967cb881a01c5e605d48c08bd

SHA1
11fbf6c5fdad48cf7bea28ce310dc0ecb2f5bbaa

SHA256
d80920db0bdc9711f732029273a1161da5329a84c8b5cf145ea2f90df57e5148

SHA512
3ddb1190e5974b00c8bc5ca04e7e450d281d55e39e5149b6f11047e19760c9cdda9cacc90762b9521d1abfb003101422ed707e9610b5dd045486383070e30911

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX25.txt

Filesize
18B

MD5
bfb6b20a17141ded6210c6bfbad2fc68

SHA1
aeb0219d988a72e86ee0e0301f0535e9285d193a

SHA256
cca05dfc2110a409ef7aec8dc354ff1ccdcf65978e2af7cbd18c4a42f416c167

SHA512
f6483eb71cdf6a4ac44bac35d5ae7d8abcd82a145529b9ab48cca9e089a68bc96d6dfed113933f717a0558d678e2f9d7ad4a76be3df599a151407bc075245f5e

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX26.txt

Filesize
18B

MD5
45664eb578b62f84ce79871958e45b49

SHA1
d50d750e8fb0f1dde828757e506c60a24a537d46

SHA256
d6e0a7de2af23f1ea39569c0812ec32308425811b3ffe62b5672963642a1b4e1

SHA512
d21913bf17fafe782d5120c74150e6126ccae39da8f514afd736bca99aef3d1eba0144130f5783a41ba28e805fcee5705b36045b874ed55f57c0662be609a1e3

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX27.txt

Filesize
18B

MD5
f2cc4abd673b38022f2d9405d97fed77

SHA1
6fc82498d581310b1e43eae106c0375723eb9dfc

SHA256
a190f63b5f1bf780c75ad17b4bf1cf57974d2b7abe6ce057f24bfbdf5b05d2e1

SHA512
49c729c77164ca12ba1676751bf21a73006c45d7fa7088b87d343162ee8071a9dce232c45fa677c3f8e7ede294475bb09b157dd75209f6d5c753369429e3a98e

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX28.txt

Filesize
18B

MD5
77858206a6ebd9cefb46c45c4a46d985

SHA1
fb4683bc50355218d61cf0b5fb4b07c585a7f9ad

SHA256
107a54da18a521b4ac005f5e42ca953d1b785c619a63af9a6983bbef59e6bd24

SHA512
f3aee6f37f4cfbc1271851232eaa7bbfb2a689e0802ec38798a6a1ea4923b8860b05fd2fbc55cb4e8cab7d8ce262151433335526c42e6fa36fa28008f8761f70

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX29.txt

Filesize
18B

MD5
691ebcb2bf8bc066613b457835201eaf

SHA1
2695e643041d3407a92fa25a05ac0b91e2b6637f

SHA256
b34bc2e62e8f6a78cb925b1b05c3fcf165229fca87f4b9d11831d1d323bd7197

SHA512
48633c9afa07e058b09387b9d4725126535611a4bc89469d85ba42b849f8588ecbaef4c3f175b20be9d29a2cfabc17d28648c66f788d302e1726fad56e7668f0

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX3.txt

Filesize
17B

MD5
c4ea0157695ab1772af904cfa31d8f82

SHA1
e0e92203178da1f96dba2fd7b7e4c3b8575868ec

SHA256
91703a98aaec0369f1ddea0f34e5bd69a4b37b6b013edfe4111b73c6cacdddc7

SHA512
86bb81df6c47225b8aeee72aae327b8d3799da07b4b8ae43a0668502ce860b82bf766f9e720e615563101be4cf7795dca646b15bfa5ae8387d6167fba38d0507

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX30.txt

Filesize
18B

MD5
bb4c7bdb1ee059cc64079f6234a78955

SHA1
8a62c400200b9eca6038293183a634de78e98e9e

SHA256
76d57508cbb19f0232601793310e012d233a38801ed01edd050351f55ed918ac

SHA512
73865e7507499cbfb972a718c89196eb561cd658a079e2a8f3bc27ef7a4d20f63d0c29510b4d940d90f2eeb93dff6d6e538ea98d83e4676b1c8d9ad982083b81

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX31.txt

Filesize
18B

MD5
29d09720b99cb9029e807c577a7b8436

SHA1
8d677c7fc176405e503005dc370771f7514cb858

SHA256
43437a77887f250c2861b4e2894c15af663dfbda5a9445d8cc85f18ff5948da7

SHA512
7e0453799675381d2ddb5c1d0fa78b523a01943b01a5a021229eb3cd64f6c11223cefb996517e34e3369cda6850216b5af016d412232eae33053ca7313ab8749

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX32.txt

Filesize
18B

MD5
3a32771cfe1909eaef9320048029f6ea

SHA1
1984259b116d0ba3ee6bca36cd5f4e9eb6fd724b

SHA256
42fcd15bb1eab531d5832e14ad24bbc0a059987edb97345bd9fd08c7920b9699

SHA512
8d25e52dfc7ad54f661991630bd9bb633997081f7341187002b10f99d2e28fb652cf3a145498983b1c2684a62bb334630f93bfcdc05b5e909c293e901f79c7cc

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX33.txt

Filesize
18B

MD5
9c71c944611cf59110f2b056ad6f706c

SHA1
eca302d358ca0910101a0c8b413464082b846a5e

SHA256
07ea7c2035c2eb87a696930fc4b20cd7bdbb8a8d8fda32a6cf054913b0560ed0

SHA512
e0efa2680d239a711aae7e1e2ecf50aee38e951a20d780a80061970b68a1237ee3d6eedeee5eb8b9f42b049315c4dbdab52917dcf0a52db050627cd1ddafd6ce

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX34.txt

Filesize
18B

MD5
cb08efa97fba4dd575f40fe250ae6540

SHA1
bcf943674a4363dfc2bb74c189b450ba51110573

SHA256
9143e89a80550b215ce07d154d17205aa6f3238d038dc9d32ccef49034ab9786

SHA512
196164085c858c7b81485a9fe330b2b2ad10e90affb16420f910e170f0a51d8341b0d907d3a93aa256e8c988a3ce5fb2f2e957a8b771d9a6b31e0e1311326b3f

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX35.txt

Filesize
18B

MD5
8e786d8d43667e5cd6ed557787e73ef5

SHA1
d31e0b759a1a18f79c95fafc0033db2179ab4e07

SHA256
4356432a8b60bbab56228e1eb1d0810c7ccc933b0c6eed9b6244127af24fa4aa

SHA512
8b0a65ecd0a5b0befe0605c9878bc20f8b487be6d18241d97dbbe69ee598ed33eefd001ffa7700addad90d999601303f76e8b916a5ef8b67938f59fb328cb6a2

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX36.txt

Filesize
18B

MD5
2643857653ecefa68848b94b216044a7

SHA1
406e7bb7f7ee42d820a1c7c567b7b0a187df035f

SHA256
7ad333ef1207200eda158aeb720b0004a42fedfe1f8be3dde6c00e4874fd66d4

SHA512
594c8112ac5c3421e7ad6407be7ebe71bc6cef78829d4e70e1fcc1203e3ebeb9ad251596964ae86abe7e6b438308e496c162e7a1d5cc4898a538089853e91d7e

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX37.txt

Filesize
18B

MD5
0602c6f0e0dfe30ff737e01223dcee9b

SHA1
ccfc2a597218bc673366960a8dd22794041261f4

SHA256
e3ccaa7de05b8a7d867440b2064dc44648e614e27b514506476a1166ed1a80bc

SHA512
65934bcfc11a971e26f8658763a0d53e7b4c3bdcaf36e2b2e3c9b20874c741b76b2a7d28885fafd265c6d2d2f1990f14fd22658fccfd68fcc2d57ed59d90a09a

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX38.txt

Filesize
18B

MD5
6c8fc36b7d46830a8258eafb35c33f5f

SHA1
bef94a4242f9de8fee4fd35a94b842e3cae1adb8

SHA256
18f5c6314f4a3de6f81c170aa82982e075f3c379ee026440047dd61e11faad34

SHA512
0f01dc7e633a02df094d5d0e5bd6f5672de1ee1a48d4ececda59ff8e79d282e2487ae917a3f3b0a0a4ba477ee691d777f5bfbdcb6248d73659b767f60201bdf2

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX39.txt

Filesize
18B

MD5
52a9b33aa2cb3459b402851d3a629f1c

SHA1
a7ce73efe79c9ccf8075e22ac7a70a9cac4f5799

SHA256
85f04cd1521d1c25716bc7ee7dd9844db613514290ab38d187224327c686c1bb

SHA512
a4e79443f502d20147d207c77857a1cc33f52ce8d4a1c1510b5955936e3aaf07891270c6e112fe09af4ce97e270e0f0077ca278999531d1d09ffccfd1d31f752

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX4.txt

Filesize
17B

MD5
48add9bfaf87494ad4739d91884e6452

SHA1
c1e0a55b4168de69ef9556b7d7424741676d510a

SHA256
a51c4c79e86ccbfdc6506058fe294873f85245dfc4dc6badc1f19e2d014421c6

SHA512
af6d9e1b8c464e3e547d173b4749829da79cf187cdb4f5a54a51e395e9a7f84e9b21c071188cb9c3d5725b45827b5fe4138fbea1d796c8882155ada398d3bcf8

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX40.txt

Filesize
18B

MD5
9054f432495a52de857ed9a63acce04d

SHA1
567e6c157ffb2c22f91bb8d84c7d0c4645967f79

SHA256
1c153fd8e1bd7276a23e77f60d40a6124c0fbd5ba69d178b8857acd79b395e54

SHA512
034905e7365e2c75fa2a166838c3f934685ebfb2305886498497fe614176c7f1050027a3f28506e911684bdd919e8bf7592bffed93e317446524d34579a05c64

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX41.txt

Filesize
18B

MD5
c60640f7ab687a254d0eab6e178d1de9

SHA1
c0aa54a9081aa554054ea805e62381c0a9493c36

SHA256
d58210309acf24ea3b94ddc8b70375b970abefec00dad82373de583538830183

SHA512
d01cb035355ed01e2f6a3146da88e01bbf029cb9f46dd0245ad52804eaf2bfaeb5e0eff71bd154294c265d4fb1bbd824ffcd37100b59a4c4da8645fefc729e73

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX42.txt

Filesize
18B

MD5
c0e75793aa0cd33a422a198a645488a2

SHA1
4de7d89e1b25641ffcbf83d6aa215034d7256dc8

SHA256
13951d1783b7d12159bff3f97ddc700d674ebdad03f9c17eae8e7e589375a6b1

SHA512
2bb5221b2bf8e33e3428a1e1467178c0637827f0a65c8b749fc7ce52babb15e784176941676920239c4db8572c8eb508a354171ebfbc7abfff2dbf3f38e71c98

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX43.txt

Filesize
18B

MD5
a17606f974e685eae0789b2a2c0d2a5b

SHA1
573cb53df924a023696207e7057ee5e9b78f0f7f

SHA256
26814e0b0df52c8669aa2eab7552534d4afbc8b4e7d60eaa361917e4d25f17db

SHA512
69de0844ada387df109d14e1efce30b184f9aeb3bde953da5fb4546a4210ecc2e5cf24ee5a59216243921c303b447956b26929f8bf63f21073b06b011a303753

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX44.txt

Filesize
18B

MD5
dd72c76efce4a36724cc0503192d51f5

SHA1
fedeba0bfadbbfef4e23eba6c158291aa5eb16c4

SHA256
68269f4a7dbac96b5f3d2a98171cb0ef5c2eacb4dfcbf9243c25c590d35edc5f

SHA512
bc6b8d9930f5c373585f019e4679bde9928feb2cdb63a712c19a2c193bddbdab5b9c419f2d4c625ba13be9146eb484417ca86247eb3dc8d1491fb814a80e6166

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX45.txt

Filesize
18B

MD5
73a318feb5ce61eb443568d328726c91

SHA1
e3b5ca26c44f71a923c41ea673982be06dde052b

SHA256
069d7edfc50e5e9e6c5d258af0f17cb7f8badd662d7e87e0e65aa2475aca01fe

SHA512
06803368a5e6899e50ac73e26d2d84a7ec7faa2ff78e726c3168c50bc978a98ef826b3e017fbde9d7e9c997a4ade8eadf65c692bc45234e166bfeee80eeb86d9

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX46.txt

Filesize
18B

MD5
8bc8da7b6d6199cf563783aea2a5beb3

SHA1
0ba9f9e28b4624f7474605db2d5cc8e87f314307

SHA256
9bc37a5182671f6b363e50ef19311698c6b519e3b24bb52ccca7249dcbf3a73c

SHA512
cda2606a394f5b0668daf79eeefeeb2bb6bfcab918675bbee7ff75d9873e003be4d51817b1051acbeff084eb843357819fb04fcfc2f52aeb2bb228a51984fa6f

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX47.txt

Filesize
18B

MD5
76492a33ea0be443584ab3dd327ff859

SHA1
f4e825b8aae3dc18156b321cdeaff0279e939290

SHA256
9eac19b3c50f94b58257ebb78d2495682a758719ab6d90c75d9f5468483e9b17

SHA512
19f28ad1abb90f31955bede84c87754a53c352c54542615f9d71ac4d196445e575bea242fbf32c2ec76d85c19717b6ca23feb52bd023289fdf4000c523c9cafc

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX48.txt

Filesize
18B

MD5
61b085345e23d9c41f716223d1b148cb

SHA1
7e4193e8a4e693d348453d4d35f04dde9d5153c1

SHA256
7fa1b3c6320cff49a53e1eb97abfa79305325841229d45cd78a993a7d0cd64a4

SHA512
5ef95d992277c0f150ec5b3dc757c2b2d5e8b59ebe478fd7b581e3218b6978e0274ce4a912b8f99325047235e61fc7bf3104dde1f778fbbf5083c67b718237fb

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX49.txt

Filesize
18B

MD5
a006e324e360acd594c12aa0eca8937d

SHA1
1a32552c29c438e0fc0745e1c4306884c9552f22

SHA256
5e24f1dc3317e19d90c0d7fa005a3e21a6d61d7f231f8a68e52cfd99b850918e

SHA512
3f1228a2abc6e4794a30b16144ed25cbf932b585dc201a47957816abb857cd08eac7b56d3c1c0afefce7557a96870ba16487464ee4b0925d7aa4833ec050d6fb

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX5.txt

Filesize
17B

MD5
08a969d5d9eaa4dfb90d3df59149cde0

SHA1
48b819ced7959f8f62eebf6a4227fcf21672d318

SHA256
2edc3ba901a3702d29dcf24aa62b6c63411dc9027902e28c123b65381b4429f9

SHA512
44e204704381bb8d4134510efef57f63a3e43a9dcd3fec61d473ecae00c0e2ffcfa6f341be5e8053bd02d182ce0e30687ccd91fb44a212fd0f85b99e5da0f1f1

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX50.txt

Filesize
18B

MD5
50bf55b47eed957418970ecdb3f002dd

SHA1
ea5a17ceb5c3bce3958eabde54bb4c2253e11826

SHA256
5a380f9ee3f93ec191a42d6117fd18febe1cd7888097b644adfbe560a12dc77a

SHA512
cc0ccb376c9015018d5f7ffa99e978451916bedf50be5da7143e4d0076c05c1d200d0ed4c157bcf7fe85d9f76dcfabb9c172a6fbb82aaa945781f757c9825932

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX51.txt

Filesize
18B

MD5
24a3a97bef8904867ea22e72e67e420c

SHA1
1036d894540d120baa26b0374769c3ffb9cb45bf

SHA256
e9dc141ad5a230dc8be221e021a72296eab91b48bacd5b9ddc34311db8ca4731

SHA512
3ecbb2f00509aedd15da4e53322c0ad8b4b0272b44e542d9126a8972e2a18bb13a92c08a5534ee72944708278f8e8b799ae2004b3df5e2ef9ab910e6457c81f2

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX52.txt

Filesize
18B

MD5
61032a360a7d165ee42b11cecc8a0236

SHA1
b09ecc1933eaf1fb089660a050b2bb023684bd8c

SHA256
4feac1a76202e509477b0b334828e249782aab7a3df133475946e782171f67d8

SHA512
9a29d4e4275698b5c9e82e714067f21503a666e2185ccb31e0e9396fe50134f394fc1d894ba01187e0224bd168d676e11fce0756064da2f24ed823dba6d321d4

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX53.txt

Filesize
18B

MD5
b57c428765b2e4a53521825eefae881c

SHA1
49164bf27e1fd9846a6971dc8b6defb15f39355d

SHA256
2a9f61348a205a6f59ec32af51fbf03425a17ee6473d4c89b68ed2a4346685d4

SHA512
ea2d1d5a386c51131f7112714b8587a69b04d6b53622875ffe2e44f383b536422b253377ed841657b20f3d0dc6084ef9f379de1323023f396f2be2f6bdaa14da

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX54.txt

Filesize
18B

MD5
5219d2c90945981f6f71bc69ab5eb94c

SHA1
6128a357f2675e9b76057c162fc2e5bcf6440daa

SHA256
0c75cdc5e08ce728b63dddce066c57140fd49a93b33aeab92a9acbe1aeaa4b6f

SHA512
4c51b0975ae1be6e70c256823630e43e4f3d066578dcc2f99871509521d0e0477be7d69a301f58c8df8450df7abd1518f1ad0fa1e2678cd64cb9dc8c033e7f66

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX55.txt

Filesize
18B

MD5
e7a23157cfb36b43bdfb6d6aab411361

SHA1
88020d7de1d72660dfd0f3340a96093f44a51f0d

SHA256
b00b6531c5b23b27b56741e0704c597df370e3800d47904c466cde33c4d6a4ca

SHA512
e3823211f9044fab5c138521615fe74a8653c4a5ebf37c8058c46e83ba81068087e3a2ef878316832ca1308abb3320ef8221fe934403b986f6382546f50a59a8

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX56.txt

Filesize
18B

MD5
8ace7e1416799a1a1cf7386175c4082e

SHA1
ef0f34b5c20bec3049c2c1bd8ea7a9cea5589e45

SHA256
e4b202d7433de780605d19f3d5f3df4f84930723e0864526afba9d3620d5f9c0

SHA512
37c5ca711392a0ab5292b541437392b81d0e988f8139c579ecec7b9251d7fe55d45e32a21af632f4f8f51c5343fc5abefce5b8dd96f5830334a17717fa111767

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX57.txt

Filesize
18B

MD5
56bb23c49c6b8d52a0da5c7db481d2e3

SHA1
6ae93bc049a607559b9b1601e9b1e6907fcf349f

SHA256
e088133e82915e289680cec22d28e3d1e93c3486b0a0a295915cda4db5058794

SHA512
b32d01a3b6700ae2a6fd634f3fb76f5b5812c2a43cf9450bd07dac35f5f4e536a107a6e0a635b1572151ee2790ac66b9ac455b2db92ddb06296b2415d6bda560

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX58.txt

Filesize
18B

MD5
1edb09eed9f1ea8b8412adc28f9a4f11

SHA1
1378cda8942b68e14565cd53732046bf096ac059

SHA256
2de27e4d911b43b17bb626666a77b1bc3119ef643841832ca14b135e6f609c87

SHA512
bd3b1ad4daf75b3c0fcbfd06190ebfbdbbb49ca80c229c91ded3b2e47221da9370001b685a9a43e843fa0baaac03418e6e35644fc68a332c2225e489fb294578

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX59.txt

Filesize
18B

MD5
77d3e3e54fd6b6b99f7ab76ac6b1f39b

SHA1
72cf5b4631e9bf65aef75c8c6784cc2218a34765

SHA256
9b1ce0e300ff714e5e6f44f887f34596179054c2228c9855fbdac7d94e236bdd

SHA512
f0c17f6ef1a3ff4ddd1cb4f60625648a6e0c7fec38e32a4cbf4bf6dbc67fec7f237fcb9f4553320faddd080f63ebff73c57e1380f84b16745f6a220a0412efad

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX6.txt

Filesize
17B

MD5
9e45e1f689078d9401f646eda1914fd1

SHA1
bcd9933a13c7a18ec77c339a5ed75c838b0df44a

SHA256
d1ca931496bbf8ced507cc5b73b9f9722934a16a6abcfbd55233fd8908cb02a0

SHA512
6c10fa8402afd99abf5dd4f86ba4fe75ac58fc5d7d6ea6d16785aaaf960a72b757d91a13a3ea0e2ffa39e10e86896152747aa5b8683bd3780d25d6b0c1f1d194

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX60.txt

Filesize
18B

MD5
5ba5af991b00f12e2e590c50c3dd61fe

SHA1
006de415131d1bed88418714ba65a6aa8e4df12d

SHA256
109d1c2d028198506c2bb2c5c0990a6522fb53724306c0da523b76fa2926e9c1

SHA512
d0d204bdd95d7ef12194d0ff04b25471c2643923e2c344c8fedd21bea36dac93c06a42e4fdcbf16cfd357fe986807e4c60dbc44a57ff4dec539d299b4cbdd7d2

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX61.txt

Filesize
18B

MD5
6f67eedd83cd57defe2168c59a5707b0

SHA1
23953ef0f4ae9584ba8c416adb0b9ff332c98dda

SHA256
34b4844416d8cc70f62ad7e4db5ac43bea248c93b6d4af7eaa7b803d11803263

SHA512
86e7ee229a039cd7b54d65cd2ca14c9bceb5c4d8c5babf615b4935511c34852d990efa6d17bfb50ce42bac829da079dd59b4806bd811df9466ab57b49128b64c

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX62.txt

Filesize
18B

MD5
a0deae9f2b68bfd590637955fc181014

SHA1
725eec257b12dd236c276267887eb05270174cdd

SHA256
25da003279ea0477aabc2f93388c6ec9afab17e43f487fe2474bb9f82a9e6e4d

SHA512
c5f4b81180b4f4d2fb783fe23dfab572505b6fa4e852f010e8b48c78d26c0afba8411c091b60ee14a1acd6bab0c6822bc56a0291e328eea088183d6ec21babf3

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX63.txt

Filesize
18B

MD5
b6a8c5fb83f440b74e1ad54ab6372089

SHA1
334811508a54b16a2f3eaffcc3caf7cad799d4e4

SHA256
cb35c1361773ff1f74c149f6f20b0aaff19b73e44b0ccc826574e957aac78eb9

SHA512
79be0a46d5382bc707c72572055fd8c5fbcc6eea91506b72f6c02aab739ffc3da3950028fa2c70bb543a1f445f7d334f0ef91cfc989db65e98bfb952633fe24e

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX64.txt

Filesize
18B

MD5
fc16944bca29ce559c5190cedcea3d45

SHA1
8a93ff88226123d5207434fa8dedb4d631333b3a

SHA256
0736bcd2cc1fc918d1360b9afbb43747a5db25809903ad9902c0029515fa3bd8

SHA512
8ddd20a456f8cd64e6ee4b0d75a3973e4021f9939f7d1772f9826bd31a7296c86afbf76d420a71d9892ed7f0e834275e49e60635d182b4a5a6904da0d0096ef1

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX7.txt

Filesize
17B

MD5
bd7381e1434e63df4d21706e40a29054

SHA1
b9389d04e7181e25ea4bc84da2178b84176a460b

SHA256
55e017d9824a3f750dc7fdd9a7e2dc74ab76380c7c845ce576afb7d19168e1c2

SHA512
952e36c991e88e74dd46160bb707f0b17f3e72995891a9b2401592b2c54669c7632be2963a0338093cb3be9dedd47cd4f35c8a839bca368ca2b34ec11efb1886

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX8.txt

Filesize
17B

MD5
1b38e60a5a67a2e23d2586e747463c1e

SHA1
2427599f0fac5743603347ebdc410812c36d538f

SHA256
e44d821e35b3e3e8fa733b99e819c339da1b1249129ea02d7fa3c1cef8f484f1

SHA512
52f88864bda68fa6c19cd78989eefe6d6499581fd93ffd9d3046765ae86812208d6aec65564f08871795011b985d73417ad1ba5e43e03aefaed0a12c7f50dfa6

Download Submit
C:\Users\Admin\Desktop\Nuked_by_SX9.txt

Filesize
17B

MD5
15a5905ab96498c9ce56fd27d093425a

SHA1
8e6e11d767e1863cdd97cb2a2335baf282826726

SHA256
86aba30bab62ebffbdd8ae8dfee536aeb6ba10c6b25ae1442d67d2fb1f47a8e9

SHA512
3959675c7d443c6d1f7fcda1ea4c28124eb27ffb1796f9526e1be562c43e9a98db817612e361971cc1f25abc0da90a841475d12fc92131168e99e075f0871c4a

Download Submit