Ransomware Posing As FBI

A scareware/lockscreen Trojan delivers fake FBI alerts (displaying alleged pornographic material), disables Task Manager and other recovery tools, installs persistence by hooking Winlogon via a userint.exe process and setting an autostart registry value, stores a malicious index.html under the victim's AppData, and continuously posts victim data to a botnet (observed POSTs every ~5 seconds) with C2 activity tied to Germany; multiple malicious download URLs are listed.