Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Modifies WinLogon for persistence

Modifies Windows Defender DisableAntiSpyware settings

UAC bypass

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Deletes system backups

Uses wbadmin.exe to inhibit system recovery.

Disables use of System Restore points

Downloads MZ/PE file