Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detect Xworm Payload

UAC bypass

Xworm

Xworm is a remote access trojan written in C#.

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.