work in progress: check if sample deletes the safeboot reg key (ransomware)