work in progress...ransomware tinkering with safeboot reg key