Responsible for changing passwords of all user accounts in the system - Drops .cmd scripts, which are responsible for deleting volume shadow copies, logging off the user, wiping deleted data and adding registry entries for ransom contact information - Responsible for the malware’s typical ransomware payload routines