Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Blocks application from running via registry modification

Adds application to list of disallowed applications.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Disables use of System Restore points