Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Blocks application from running via registry modification

Adds application to list of disallowed applications.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Modifies Windows Firewall