# Defender

`C:\ProgramData\Microsoft\Windows Defender\Quarantine`\
`C:\ProgramData\Microsoft\Windows Defender\Support`\
`C:\ProgramData\Microsoft\WER`\
`%User Profile%\AppData\Local\Microsoft\Windows\WER`

Process log: \
SHA1, detection, tainted, SDN Query

Microsoft-Windows-Windows Defender%4Operational.evtx
