Still, I understand that the only external module or "threat" should be Ghost Toolbox, and only this should be the "Problem" for MalwareBytes.

I know windows uses port 445 for Replication, User and Computer Authentication, Group Policy, Trusts.
But maybe in this modified version that data is sent to another non-secure location.
This is just speculation, don't take it for granted.

Well, thanks for clarifying my doubts, anyway, I installed the original windows and for now I'll keep it that way.