File name:

Win11Debloat-master (1).zip

Full analysis: https://app.any.run/tasks/9604f2da-add0-4252-ae32-ce3ed8989554
Verdict: Malicious activity
Analysis date: May 25, 2025, 19:14:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

0D0CD950101BA2EBD3E5A6B80284FCAA

SHA1:

406485C7E578E601578E6EBAA54EEC3D815418E1

SHA256:

E42CC30284975B9CC50BC9F10DAF39B87527D1960444B3C737E1BF54070F0CF5

SSDEEP:

3072:r4lD1sAryxD/rNVEwbdFlaiB/lAEOHvpuxQzZ:rMyxDXdFlaiB/lEcCt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7516)
      • powershell.exe (PID: 7796)

    • Changes powershell execution policy (Bypass)

      • WinRAR.exe (PID: 6048)
      • powershell.exe (PID: 7516)

  • SUSPICIOUS

    • The process executes Powershell scripts

      • WinRAR.exe (PID: 6048)
      • powershell.exe (PID: 7516)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6048)

    • Starts POWERSHELL.EXE for commands execution

      • WinRAR.exe (PID: 6048)
      • powershell.exe (PID: 7516)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 7516)

    • Application launched itself

      • powershell.exe (PID: 7516)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5556)

    • Searches for installed software

      • dllhost.exe (PID: 4980)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 3268)
      • DismHost.exe (PID: 4188)
      • DismHost.exe (PID: 4436)
      • DismHost.exe (PID: 6652)
      • DismHost.exe (PID: 1052)
      • DismHost.exe (PID: 4944)
      • DismHost.exe (PID: 5600)
      • DismHost.exe (PID: 8176)
      • DismHost.exe (PID: 8104)
      • DismHost.exe (PID: 896)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7796)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 7796)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6048)

    • Disables trace logs

      • powershell.exe (PID: 7516)

    • Checks proxy server information

      • powershell.exe (PID: 7516)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7516)
      • powershell.exe (PID: 7796)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7516)

    • Manages system restore points

      • SrTasks.exe (PID: 7444)

    • The executable file from the user directory is run by the Powershell process

      • DismHost.exe (PID: 6652)
      • DismHost.exe (PID: 3268)
      • DismHost.exe (PID: 4188)
      • DismHost.exe (PID: 4436)
      • DismHost.exe (PID: 4944)
      • DismHost.exe (PID: 5600)
      • DismHost.exe (PID: 8176)
      • DismHost.exe (PID: 8104)
      • DismHost.exe (PID: 896)
      • DismHost.exe (PID: 1052)

    • The sample compiled with english language support

      • powershell.exe (PID: 7796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:21 12:57:40
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Win11Debloat-master/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
21
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs dismhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896C:\Users\admin\AppData\Local\Temp\F753FA58-B8B4-464E-998B-CE64F57E674A\dismhost.exe {5D130E53-EC59-42BB-8E29-2D2E12988FA6}C:\Users\admin\AppData\Local\Temp\F753FA58-B8B4-464E-998B-CE64F57E674A\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\f753fa58-b8b4-464e-998b-ce64f57e674a\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1052C:\Users\admin\AppData\Local\Temp\6D4384D8-9271-4028-94D0-D5B3BB725C73\dismhost.exe {D53B1F3F-8A9A-4CBD-93F2-D0F0A1676706}C:\Users\admin\AppData\Local\Temp\6D4384D8-9271-4028-94D0-D5B3BB725C73\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\6d4384d8-9271-4028-94d0-d5b3bb725c73\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3268C:\Users\admin\AppData\Local\Temp\B0B85844-51EE-4660-B2C9-5144CC2290CF\dismhost.exe {4E55D916-30DA-4E8A-9A62-B76C56EA4B35}C:\Users\admin\AppData\Local\Temp\B0B85844-51EE-4660-B2C9-5144CC2290CF\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\b0b85844-51ee-4660-b2c9-5144cc2290cf\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4188C:\Users\admin\AppData\Local\Temp\E44D27E3-4B40-4064-ADD4-010C9952E5CE\dismhost.exe {D3D9ECB0-81EA-4B32-B0D4-98E0A149CA35}C:\Users\admin\AppData\Local\Temp\E44D27E3-4B40-4064-ADD4-010C9952E5CE\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\e44d27e3-4b40-4064-add4-010c9952e5ce\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4436C:\Users\admin\AppData\Local\Temp\91EA0E66-6087-452B-8E66-CD550EE80B5D\dismhost.exe {E59264DB-4158-4A3A-838E-7416B111225D}C:\Users\admin\AppData\Local\Temp\91EA0E66-6087-452B-8E66-CD550EE80B5D\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\91ea0e66-6087-452b-8e66-cd550ee80b5d\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4944C:\Users\admin\AppData\Local\Temp\ACE5FAB6-5BC3-43EB-BCD7-C5D75E3DE2BF\dismhost.exe {389EEC64-F53F-4457-B39D-E0DA8F15FBE0}C:\Users\admin\AppData\Local\Temp\ACE5FAB6-5BC3-43EB-BCD7-C5D75E3DE2BF\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ace5fab6-5bc3-43eb-bcd7-c5d75e3de2bf\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4980C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
5556C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5600C:\Users\admin\AppData\Local\Temp\BD4BAC18-DD41-42BD-A791-AC60B860899C\dismhost.exe {2EB0AE67-C768-404C-B75F-5BD7C4C45473}C:\Users\admin\AppData\Local\Temp\BD4BAC18-DD41-42BD-A791-AC60B860899C\DismHost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\bd4bac18-dd41-42bd-a791-ac60b860899c\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
6048"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Win11Debloat-master (1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
19 116
Read events
18 905
Write events
193
Delete events
18

Modification events

(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Win11Debloat-master (1).zip
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\OpenWithProgids
Operation:writeName:Microsoft.PowerShellConsole.1
Value:
(PID) Process:(4980) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000001E591049A9CDDB017413000094100000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
528
Suspicious files
11
Text files
131
Unknown types
0

Dropped files

PID
Process
Filename
Type
7516powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:C03C92A29271DD4FE5EC2D87C5075978
SHA256:E6343A3C0A09BEC26BB4BF3394E9A2D2647357908D45BEF792F98E709DDE2C42
7516powershell.exeC:\Users\admin\AppData\Local\Temp\Win11Debloat\Raphire-Win11Debloat-44c28be\Appslist.txttext
MD5:1D29ED1E13847135A35B91ECC01E647C
SHA256:E5786B02500739D79CA1EA766E3E385E6E5A3CEE5AA1648963911CDFB649F74C
7516powershell.exeC:\Users\admin\AppData\Local\Temp\Win11Debloat\Raphire-Win11Debloat-44c28be\.github\ISSUE_TEMPLATE\bug_report.mdtext
MD5:B2789232920B9E799162EAE6DA814073
SHA256:6B8985DBAC1605AFAE6997A7EE8B3FC729D0DFC530E2E3D846825B88D53E5029
7516powershell.exeC:\Users\admin\AppData\Local\Temp\Win11Debloat\Raphire-Win11Debloat-44c28be\Assets\Menus\DefaultSettingstext
MD5:650357F4EAF4B88F9A0091B23B7B444D
SHA256:33CB97F61F1F3C4A99B78844CF8C846F252CDC9AB0146F6518BB9727C62941F9
7516powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x5wx3zks.awg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7516powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10d35f.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7516powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7QNZDD7GKOQ5XCTCU4CH.tempbinary
MD5:C03C92A29271DD4FE5EC2D87C5075978
SHA256:E6343A3C0A09BEC26BB4BF3394E9A2D2647357908D45BEF792F98E709DDE2C42
7516powershell.exeC:\Users\admin\AppData\Local\Temp\win11debloat-temp.zipcompressed
MD5:FA61AC2734DECD8D03BCE15681B54787
SHA256:79711A9ED7467CDEDAEC7DD5AA973D73DB5B398892E80A4F5E7F96611184157E
7516powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1mjxvz2k.55p.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7516powershell.exeC:\Users\admin\AppData\Local\Temp\Win11Debloat\Raphire-Win11Debloat-44c28be\.github\ISSUE_TEMPLATE\feature_request.mdtext
MD5:174545E1D9DAFF8020525FDD1E020411
SHA256:1F48C52F209A971B8E7EAE4120144D28FCF8EE38A7778A7B4D8CF1AB356617D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
29
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8160
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8160
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7516
powershell.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.130
  • 20.190.160.5
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
github.com
  • 140.82.121.3
whitelisted
codeload.github.com
  • 140.82.121.10
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Win11Debloat-master (1).zip