You should add Process Manager while executing files, and I don't know if you doing a test on a VM or in your host pc... if you are doing it on a VM, you can record screen on the host pc which i powering the vm, and also try another recording software, mainly bc the software makes the recording laggy; if you are doing the test on your host pc (which is quite risky), please try another software to record and activate it, it is pretty nasty having that Bandicam.com message on the top of your screen.
For the next tests please use more samples and also name each sample with the name of the ransom, ex: BILL8957 (Cerber), CC_setup (Cryt0L0cker).
Also I think these test can be improved using your own voice, not NCS music.
I wish you improve these things.
Greetings, Lucas1533