From a07f58160a4eb31825157294c8236dff26162f83 Mon Sep 17 00:00:00 2001
From: Iaan D'Souza-Wiltshire <iaan.wiltshire@microsoft.com>
Date: Mon, 15 May 2017 18:49:31 -0700
Subject: [PATCH] minor changes for markdown escapes

---
 ...rypt-ransomware-worm-targets-out-of-date-systems-wdsi.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
index 824f7fb880..6d73bea83b 100644
--- a/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
+++ b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
@@ -71,7 +71,7 @@ When run, WannaCrypt creates the following registry keys:
  
 It changes the wallpaper to a ransom message by modifying the following registry key:
  
-- *HKCU\Control Panel\Desktop\Wallpaper: '\<malware working directory>\@WanaDecryptor@.bmp'*
+- *HKCU\Control Panel\Desktop\Wallpaper: '\<malware working directory>\\@WanaDecryptor@.bmp'*
  
 It creates the following files in the malware's working directory:
  
@@ -134,8 +134,8 @@ It creates the following files in the malware's working directory:
 WannaCrypt may also create the following files:
  
 - *%SystemRoot%\tasksche.exe*
-- *%SystemDrive%\intel\<random directory name>\tasksche.exe*
-- *%ProgramData%\<random directory name>\tasksche.exe*
+- *%SystemDrive%\intel\\\<random directory name>\tasksche.exe*
+- *%ProgramData%\\\<random directory name>\tasksche.exe*
  
 It may create a randomly named service that has the following associated ImagePath: `cmd.exe /c '<malware working directory>\tasksche.exe'`.