Reply to thread

Message: <blockquote data-quote="cruelsister" data-source="post: 998821" data-attributes="member: 7463"><p>Controlled Folder is shown to be active at 2:14. As to Shadow copies, a similar variant was shown to delete (vssadmin) them at the 1:30 mark of the AppCheck Overview video (and at 2:08 of that same video WF was shown to be disabled by the malware). And although it wasn't asked, at 1:16 of the Defender and VirusTotal video UAC alerted to Task manager starting which is only done with UAC at Max. UAC did not, however alert to the malware.</p></blockquote><p></p>

Top