: Disconnect infected machines from the network immediately to prevent further spread [4].
: Scans the local network for SMB shares to encrypt mapped and unmapped network drives [5]. Technical Indicators snzh.7z
: Uses vssadmin.exe to delete Volume Shadow Copies, making local recovery without a backup impossible [2, 4]. : Disconnect infected machines from the network immediately