Microsoft 365 Defender's Live Response Sessions downloads evidence collected through the getfile command as-is, often resulting in additional AV/EDR alerts triggering. This extension encapsulates getfile downloads into password-protected ZIP files with the common infected password. This extension is not created/owned/endorsed by Microsoft.