PowerShell process used to delete Windows Defender, e.g. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse  8. File InstallUtil.exe running from C:\Users\[USERNAME]\AppData\Local\Temp directory.