“Once executed, VanHelsing appends the ‘.vanhelsing’ extension to the encrypted files, modifies the desktop wallpaper, and drops a ransom note named ‘README.TXT’ on the victim’s system ...