Modifies WinLogon for persistence

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Disables Task Manager via registry modification

Drops file in Drivers directory

Possible privilege escalation attempt