Pay2Key Ransom Note Display via notepad.exe Opening HowToRestoreFiles.txt
Detects the Pay2Key ransomware displaying a ransom note by spawning notepad.exe to open a file named 'HowToRestoreFiles.txt' located in the 'C:\temp\' directory, typically as a result of execution from registry persistence keys.
YARA-L
