Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

Hide Artifacts: Hidden Window

Windows that would typically be displayed when an application carries out an operation can be hidden.

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Executes a VBScript file via the Windows Script Host.