00d1487b2e9b9691653774cc781ed3844e4b2fd5b0d91c32f6f78aa8c7892bd4 | Triage™

Login
Reports

Overview

overview

Static

static

Win11Deblo...NG.ps1

windows10-2004-x64

3

Win11Deblo...NG.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...un.bat

windows10-2004-x64

5

Win11Deblo...un.bat

windows11-ltsc_2024-x64

5

Win11Deblo...ps.ps1

windows10-2004-x64

3

Win11Deblo...ps.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...ge.ps1

windows10-2004-x64

3

Win11Deblo...ge.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...ps.ps1

windows10-2004-x64

3

Win11Deblo...ps.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...st.ps1

windows10-2004-x64

3

Win11Deblo...st.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...al.ps1

windows10-2004-x64

3

Win11Deblo...al.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...ns.ps1

windows10-2004-x64

3

Win11Deblo...ns.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...ns.ps1

windows10-2004-x64

3

Win11Deblo...ns.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...gs.ps1

windows10-2004-x64

6

Win11Deblo...gs.ps1

windows11-ltsc_2024-x64

6

Win11Deblo...ns.ps1

windows10-2004-x64

3

Win11Deblo...ns.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...ss.ps1

windows10-2004-x64

3

Win11Deblo...ss.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...er.ps1

windows10-2004-x64

3

Win11Deblo...er.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...es.ps1

windows10-2004-x64

3

Win11Deblo...es.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...on.ps1

windows10-2004-x64

3

Win11Deblo...on.ps1

windows11-ltsc_2024-x64

3

Win11Deblo...re.ps1

windows10-2004-x64

3

Win11Deblo...re.ps1

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
Win11Debloat-2026.08.24.zip
Size 451KB
Sample261020-1bhadswtex
SHA256 00d1487b2e9b9691653774cc781ed3844e4b2fd5b0d91c32f6f78aa8c7892bd4
MD5 64c33c6ba6b3915e90a2f9ae471067bb
SHA1 89c4c0d987b8d860d14d673e1ae39ba936922878
SHA512 fdcfb5764e65a7a3990b7b121f5d5e76371b3a16c54f409af713414ae069da8984d3e70ae4a52c8d8cd9d14dca3901eadf1f68eff06a8b1b67c4925adc8192fb
SSDEEP 12288:7QffnzVyai5eP8qdXQJ3XCnyfNmjun8ulWw:UffnzVU3XC4icb
TLSH
T113A48DE04C70D942FE41D0B60A44A59BC601E6E0BE191B736A15A07DFC8A2293FBF5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Static task

static1

Behavioral task

behavioral1

Sample

Win11Debloat-2026.08.24/.github/CONTRIBUTING.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

Win11Debloat-2026.08.24/.github/CONTRIBUTING.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

Win11Debloat-2026.08.24/Run.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

Win11Debloat-2026.08.24/Run.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Get-WingetInstalledApps.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Get-WingetInstalledApps.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Invoke-ForceRemoveEdge.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Invoke-ForceRemoveEdge.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Remove-SelectedApps.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Remove-SelectedApps.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Test-AppInWingetList.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

Win11Debloat-2026.08.24/Scripts/AppRemoval/Test-AppInWingetList.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliAppRemoval.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral14

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliAppRemoval.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeAppRemovalOptions.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeAppRemovalOptions.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeOptions.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeOptions.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliLastUsedSettings.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliLastUsedSettings.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliMenuOptions.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Show-CliMenuOptions.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Wait-ForKeyPress.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Wait-ForKeyPress.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Write-CliHeader.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Write-CliHeader.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Write-PendingChanges.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

Win11Debloat-2026.08.24/Scripts/CLI/Write-PendingChanges.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistryFeatureSelection.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistryFeatureSelection.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistrySnapshotCapture.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistrySnapshotCapture.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
https://github.com/Raphire/Win11Debloat/archive/refs/heads/master.zip

Targets

- Target
  Win11Debloat-2026.08.24/.github/CONTRIBUTING.md
- Size 16KB
- SHA256 2a0e403195d5b7a757f7947f481b7a97a8d8e1760e185d354a961f521eddd91c
- MD5 875b54b30570d88048681db391bf951e
- SHA1 ded63231ff237ee69d92baefc8e1cd652d447b05
- SHA512 b4695c892747164201df8d6b076427db18ba6accb84b7ac067f4ccb53e1a1734a0bb70e1b5eed6d328976b150435bf084ec09de63c2f74d723599505087888a4
- SSDEEP 384:5PLaoV6ZwUpJFCctFrKFwKKwjRy0mewCJHROAUt3sPaad9ROQ0oN9pcwXXxK:5PLaowwUpqcn2FlKwIq2Bx6ROVoqwRK
- TLSH
  T1E372192E3C18577707D311BA250E52D9BF21AAEEA742247A759CD08833C96EC42BF5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Win11Debloat-2026.08.24/Run.bat
- Size 1KB
- SHA256 3c0e42dc17b901dea7ecef460f5763240b99a3d7f955c428862dacc8e895c4eb
- MD5 918b0691710dfc1e5ea0834d485a39aa
- SHA1 e29b5f1720619677e7da95b9b0753f6529ee044a
- SHA512 ae627ab80370c20a3b5f544b31b9dd2100c58a04d870e28405c5e870148f80777e7c8549bcb671f51879dc591d3f1c2456452abaa418b8d10799d634e810424d
- TLSH
  T1DA316655123C4352889D937C404C5277652A437B236E9BCC752C652CBE19AD5C27F3DA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral3 behavioral4
- Target
  Win11Debloat-2026.08.24/Scripts/AppRemoval/Get-WingetInstalledApps.ps1
- Size 3KB
- SHA256 e28713f6f8df6bc71c8b25b50f1cf1b99d42f1ca7161d5cbd9ab82515c6cc069
- MD5 eaf2271e5e17cf304f8fe20fdf0474fc
- SHA1 cf5a3f9d6cb4380dd08fd0f492c8cf70feab6cd2
- SHA512 dac1ca30d2875b181f4e5cad9588e187a51b7a38199727130390e368906ccc371436f7cd5bbda29f502d68b79020887adef7acbbd57721e79a711606f6242063
- TLSH
  T1FB71540A7DF6D2B4224B70360EDBE54866299127850C5F04BDACCCD4AF86520D7BCAD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Win11Debloat-2026.08.24/Scripts/AppRemoval/Invoke-ForceRemoveEdge.ps1
- Size 5KB
- SHA256 601e8e7dd513eca990191cc841871a2d2fccb5a2992bc6bae375eed60e53285f
- MD5 9471a61e31b4a6904ce4d63efaf23c87
- SHA1 73f389c86a0361b1307dc65e19618f2653bae24e
- SHA512 a73c7ded9b2a4b80e05b4831470def0210e55eb9f0c039fea06f77871bd74b202acafa4488ff2e52dbe2339e86d3c0fc3159eeef2c9daae054b756c2d96bfe36
- SSDEEP 96:ERNqSyHQvaxw5MSxHfGDiEqZXZOZC7i2HABCBA81281M8a28a75CcnGUnBdJITXR:bHbD2HABCX5/1nBdJYHdwrDVy
- TLSH
  T1D0C16336E8A3457799D232290C875114BD95879FC5055F64FC9E8248BF932DCC1F63A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Win11Debloat-2026.08.24/Scripts/AppRemoval/Remove-SelectedApps.ps1
- Size 14KB
- SHA256 4e9f10b59a5b504eb2d3004e59656f56749eef4fb3a2784a3a7e93424df00ae9
- MD5 52c4a4ff66013bee5242f181c193d7cf
- SHA1 af4b662a6cbc6af84a163f67785287c50351df23
- SHA512 1a18f0190c7cd05fdc8ae2d851da5a038912414bca70ba35f5c38a3298991901cbbbb51c42845572aa8c0212cabeb608eef94bfbb9f7afda4404143036500d3b
- SSDEEP 192:SB6p/yReyP3ywjdSXFyMpO2xMNqTBTAOvIBSIOEgTETfmV5cDFlIsw7f0YWCiSCk:SzgGNHXmAasw7//V8NZZBO
- TLSH
  T1AA62B817AED346E829D3157F2CDA4404BA18923BE1491F907CDF0288EF425BCDAB6E95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Win11Debloat-2026.08.24/Scripts/AppRemoval/Test-AppInWingetList.ps1
- Size 1KB
- SHA256 a04846eaa51149b1586d897c2782029879dad524369a88e9fe8317abaf8bc126
- MD5 a3031286d194ce39b62d5bda930b577c
- SHA1 54affcb27ce62d5c4ac9350b095bef9a83a6259a
- SHA512 05339b223481dfb89286803f2dd7cf3de0ea6ac81934049bfbc7b88e0037455a61c1d693aa748bc7fd19143833fa9c4c12734570dbac0ef13ca7a9ac4413b890
- TLSH
  T17C211152A560821D29E29A3F0CCF6B946408C55753982BB4BEDE93003F5327991BC44E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Show-CliAppRemoval.ps1
- Size 941B
- SHA256 3daa794913f5e2eb0b3823344de0ea0da8605394565d96e75186383fa97fb3ce
- MD5 9c132c14c485938a0197903be87edfc2
- SHA1 ec67b875b5f6683bdb4926ae62c365da8d442a82
- SHA512 80d447067f91c1b722e8d304cdea8222ece8593f5cd8f3c62e99fc70cf242768517a5fdee4aa1fa24d7fe3496ab437b43ec3cd40b24a10788d9727c85d57ef89
- TLSH
  T11011CC00EDC0165415EF007F2DC4E4D8E2D011AFD9492F50346D1C862F84C2EEA62D9B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeAppRemovalOptions.ps1
- Size 1KB
- SHA256 3fa6669fa81bac62a8bf2752f342541ef120c50d5bad7acbf60a012ff1abf2e9
- MD5 88a8031293ff53dd4d9b1fe0ab2b62d2
- SHA1 c643f5d940f99deada734f4f4d27b617942abe1c
- SHA512 cb270f519d849ff3c5c513773839177af80183738541478ad056bfeda27a1298f24026b89a7f566253ef732fcef257f1cbc8e75f790efd4362f8af28b989cdd9
- TLSH
  T15C310F2165499F0C19D7007F0BC8F40076D8A12FD09A6D94726ED09C3F8907D97A36EF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Show-CliDefaultModeOptions.ps1
- Size 1KB
- SHA256 add2bfbf6ed4256758f2e7b3a0dbe4f26678a0cf6d6f9a535900c846134dab79
- MD5 ced724d5e294bbb2d20a55f58a1c1596
- SHA1 a71d582d830f4751150e7b20392d648a7d36e73e
- SHA512 6a886fc91430eba17dac3939b36aa0e7509ef0e83056c0aaffe3320535fc3d884882ef0282e0ff0341b280c705f90c34215ecd6508fb8c038bfd25bcbe8bdab0
- TLSH
  T18A31CC687DC5C9199087546B37E4861436B8595FF10CAE0838FD858C5F9BA78EF90F11
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Show-CliLastUsedSettings.ps1
- Size 597B
- SHA256 d662e1a6b175238e5e3d87b26e19c046e62509d4b2b572a6641af1c2473732ec
- MD5 91d058a9f66464f49a075c34fa07d799
- SHA1 5755ca4f508fc8ae467d78a39fa6f719e9cfd242
- SHA512 aed489f2bc395756ae149ccdcae7be698e84ebd0b66ec69af016733fc6017c34b9e2095dbb3b8b58d1cceb7da78f93345b3496e693fb6eee717d3110dda71a04
- TLSH
  T10FF0E11CE96A422D905147BED90E831910FA99CF9224AF68356C40090FC928C6BD5AC2
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral19 behavioral20
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Show-CliMenuOptions.ps1
- Size 996B
- SHA256 d51e602526375e1dcd6f36eb51f552a90e088eb9ac62f3518b880cbb75666d6e
- MD5 f57069705809255ece73b137b510d51d
- SHA1 b4054a933070cc5d5b350e0664f4e010754c303a
- SHA512 a822675fbc459d23ad879edb0f51b3f1053486b3fee70172e0d45e116fd7685ad5a235a0a08405940314101c219d34351e9c999365f99632baa094c9a11041e1
- TLSH
  T194110415F4467F1C41CD10AF5CDA7441A1E8111F62696978701C45ECBF0CAACD1DBE9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Wait-ForKeyPress.ps1
- Size 488B
- SHA256 f1476068db81171a803480267fa6403b66282d2fc952e3aa8390fbc4db9a955e
- MD5 fcd6d97a67b938e00a73b0138c730496
- SHA1 277a5805f6a4d19f247c7efb81069b8add43ab91
- SHA512 cb9c7c456a4212081d9a840863d592de2df5b7c7947b3df4a0addaf5d82a86bb47c620e5a11759be95143f83a92d96e9326988cfc923f179269ce4be0610272e
- TLSH
  T199F054197CC09354108A40750D56428797A9367F5849AF04785C5E0D7FCEE0D95F0FD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Write-CliHeader.ps1
- Size 587B
- SHA256 890a7f045039bfe94bdc39046189235ccb0873f5bb90ed4eabded8a91d2c90d8
- MD5 23302a19a0bc51a18d767abf984aa7f2
- SHA1 b396e27eb9d447c1a389f70c04aadb0823ad69aa
- SHA512 b07eec34ed2fcb5d3c443f6bedce378775fe0455e156254e9a79629e2d14d6d0f58059a023642b02a9c7f528539ef940568d74707dc5cb466a0a2dfe457c2cba
- TLSH
  T11CF02B287C504EE40247E23A08D6CDDBD9C4002BD0F45C51BDCC488AEF9E14CC48C8B2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Win11Debloat-2026.08.24/Scripts/CLI/Write-PendingChanges.ps1
- Size 1KB
- SHA256 ae606b25ab3948cd7b58c0c7be399dea24a01ff13c2156238dc1ab13fdee15b6
- MD5 c2e2ea90e8a6b4f37dbcb29517d848b7
- SHA1 ce771104f21abf0b0c22781865d1d683b1a2e1af
- SHA512 207f0e4e820c84e3f160a6331715811a04cc4ee67c780fece8bb2e22fa70f9217c5c2c84e630d0d717a2563437b98ad6fd06a6707647719b132b850500eea5a0
- TLSH
  T16441F5188D9543DE08C700BB1C46E0906599C5F7F14E7D00789C9D582FCE9FDE865B58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistryFeatureSelection.ps1
- Size 364B
- SHA256 a25dc4c672408d4e03e1ea78b418a14a1e983d5a09c6cc5bba03932c20987d3e
- MD5 2f1748b87ac62339db874f959340342f
- SHA1 959d88c4d69e8f5bfae5d620a70e5c7afb5858f1
- SHA512 5f2f39778c1af5a4f00115dd3c9de68fe772df0809fde9603ad5875614d51b6eb1172db5a6ebf99d46fea1976a22a811565064102a8ff1cb250b663a7838b43a
- TLSH
  T18CE0C60F6A02800E1FA315F89E232CA0FD0E68CB08852654B8EC72C53FCA9E0C138802
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Win11Debloat-2026.08.24/Scripts/Features/Backup-RegistrySnapshotCapture.ps1
- Size 10KB
- SHA256 f4803447279a0d13908841e6d766dd4f4616898226db072111f18937e113f76c
- MD5 421e04550a6f4c062b9f5ce798b8aee4
- SHA1 887ee24bb8cb5a4cd363796d99dca4864b680e5d
- SHA512 87008642619d33c7a9ecfa1ab2184639c0aa714879bd2f3716c69dbf7093fe3ebb3f485eb25cd683bb8dbed792951919b60b30676798e0062dd32426f99251b5
- SSDEEP 192:ka0N7YhHB97nl9OyXDCWtJBPyWBPyJKtSqw0aPlXjJdwOh2sl65iffviRum9sfPE:McL9PDCKB7Bxw0aPlz4bsw5iff4um9sk
- TLSH
  T1AE32135DEED6915607C3327D0C994018AF3F9817081C1E51B9DC63C0FF959BCAAB9BA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy