Nefilim also uses bcdedit.exe twice to disable automatic Windows recovery features by modifying boot configuration data. bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Moreover, the Nefilim ransomware uses wbadmin to delete the backup catalog: wbadmin delete catalog -quiet