Update 9/14/16: Avira just posted a very informative article on the offline mode of Locky here. Locky ransomware goes on Autopilot. Based on that article and from information directly from Moritz ...