Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Lokibot

Lokibot is a Password and CryptoCoin Wallet Stealer.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Blocklisted process makes network request