bandersnatch.exe
when activated by clicking on it (display name will be something important like NVIDIA Control Center, or a system file, something critical for the computer to run), it deploys a rootkit into the lowest possible levels of the system that subtly encrypts every file it comes across, but doesnt save the encrypted file over the original yet. after a few days, when a predetermined zero day comes around, the rootkit shuts the user out of the system on every account, including safe mode. it then generates a 4096 bit RSA encryption key and simultaneously saves the encrypted files over the original copy, and then creates a screen informing the user that to unlock the system and decrypt the files using the RSA key, he must hand over a substantial sum of money. once this is done, the virus decrypts the files and deletes itself but leaves the rootkit intact listening on a random port for more attacks to be carried out once given the order by the primary C&C server
