Renames multiple (17512) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Drops file in Drivers directory

Manipulates Digital Signatures

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.