Safe Boot

https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/
http://www.malware.unam.mx/en/content/ransomware-impersonates-federal-police-identity
$data += [PSObject] @{Path='HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\'; Entries='AlternateShell'}