Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Modifies Windows Defender notification settings

UAC bypass

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Event Triggered Execution: Image File Execution Options Injection

Possible privilege escalation attempt