Contains two DLL function exports: start and ss2 - Not dropped to the disk - Responsible for terminating processes and stopping/disabling services related to endpoint security - Responsible for file encryption - Responsible for creating multiple worker threads for encryption - Responsible for creating the ransom notes - No longer uses the process rundll32.exe as a loader, but instead uses the MegaCortex binary as the DLL loader - Responsible for deleting volume shadow copies using vssadmin.exe and wiping deleted data from all drives using cipher.exe