using the "Windows To Go" feature, which allows you to boot the full OS from an external drive.
| Action | Malicious Intent | |--------|------------------| | Drops a DLL named wlanapi.dll into System32 | DLL side-loading to intercept network traffic | | Creates scheduled task BrowserUpdate | Runs every 4 hours to download updated malware | | Modifies Windows hosts file | Redirects Microsoft activation servers to localhost (harmless for activation, but also blocks Windows Update) | | Injects code into explorer.exe | Persistence without creating a new process | windows loader windows 11 portable