Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detect Xworm Payload

Modifies Windows Defender Real-time Protection settings

Xworm

Xworm is a remote access trojan written in C#.

Xworm family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.