: Deletes Volume Shadow Copies and disables Windows Startup Repair to prevent system restoration.
: Disabling of "System Restore" and "Automatic Startup Repair".
: Use Endpoint Detection and Response (EDR) tools to monitor for Cross-Process Injection , where a process writes to the memory of another.