Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Renames multiple (7798) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Possible privilege escalation attempt

Sets service image path in registry

Windows Defender anti-emulation file check

Defender's emulator always creates certain fake files which can be used to detect it.