 Both versions have been compiled with the same compiler (believed to be GCC 3.x and above based on the mangling of export names), resulting in very similar exports between not only the ransomware variants, but also other malware that we have linked to the potential author (Figure 11).  The biggest difference between the versions is the interesting addition of a secondary payload embedded within version 2.