Downloader Macro The LooCipher Ransomware When the ransomware is executed, LooCipher will create a file called c2056.ini on the Windows desktop where it will store the unique ID for the computer, a time limit when the key will allegedly expire, and a bitcoin address. LooCipher Configuration File The ransomware will then begin to encrypt the files on the computer. LooCipher Encrypted Files Ransom notes will also be created called @Please_Read_Me.txt that contain a ransom amount in Euros, a bitcoin address to send payment to, and instructions on how to make a payment. LooCipher Encrypted Files LooCipher will also change the desktop wallpaper to another ransom note that contains similar information as the ransom note. Protecting yourself from the LooCipher Ransomware As ransomware is only damaging if you have no way of recovering your data, the most important thing is to always have a reliable backup of your files. Neither NO ONE ANTIVIRUS CAN BRING YOUR FILES BACK, the only thing they could do is delete the decryptor software, but it's impossible they can recover your files, and if some of them is trying to sell you that, we invite you to purchase it and try.