File name:

Winhance.ps1

Full analysis: https://app.any.run/tasks/109e6a91-761a-4440-bc35-bdcdb55c8878
Verdict: Malicious activity
Analysis date: February 12, 2025, 19:26:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

60CF39CDA00FC2FCA602B924EC1D5700

SHA1:

CE16EB16FA02AD3A2706870673890945618A791A

SHA256:

B3B6AEC0DA55A5BFA2FCEE847DBEEF5A5EE327AC2E5F7886629B637B6F7F8954

SSDEEP:

3072:IC2nUjV7vP5uxu1RkswSiRyw7sVuEK78qpfGdnZYKGwNLn/uVLgoUiqCtnewM:t2ngV7vP/SsVuEKVfGdnZnVn/igtp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6152)
      • powershell.exe (PID: 6932)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6932)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6152)

  • SUSPICIOUS

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6588)
      • csc.exe (PID: 6752)
      • csc.exe (PID: 7084)
      • csc.exe (PID: 7132)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6588)
      • csc.exe (PID: 6752)
      • csc.exe (PID: 7084)
      • csc.exe (PID: 7132)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 6152)
      • powershell.exe (PID: 6932)

    • The process executes Powershell scripts

      • powershell.exe (PID: 6152)

    • Application launched itself

      • powershell.exe (PID: 6152)
      • MicrosoftEdgeUpdate.exe (PID: 6708)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6152)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 6152)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6932)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 6932)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 6848)

    • Hides command output

      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 6848)

    • Process drops legitimate windows executable

      • MicrosoftEdgeUpdate.exe (PID: 6708)

  • INFO

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6588)
      • csc.exe (PID: 6752)
      • csc.exe (PID: 7084)
      • csc.exe (PID: 7132)

    • Create files in a temporary directory

      • csc.exe (PID: 6588)
      • cvtres.exe (PID: 6716)
      • csc.exe (PID: 6752)
      • cvtres.exe (PID: 6784)
      • csc.exe (PID: 7084)
      • csc.exe (PID: 7132)
      • cvtres.exe (PID: 7152)
      • OneDriveSetup.exe (PID: 4300)

    • Checks supported languages

      • csc.exe (PID: 6588)
      • cvtres.exe (PID: 6784)
      • csc.exe (PID: 6752)
      • csc.exe (PID: 7084)
      • cvtres.exe (PID: 7104)
      • cvtres.exe (PID: 6716)
      • csc.exe (PID: 7132)
      • cvtres.exe (PID: 7152)

    • Reads mouse settings

      • powershell.exe (PID: 6932)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Creates files in the program directory

      • powershell.exe (PID: 6932)

    • The sample compiled with english language support

      • MicrosoftEdgeUpdate.exe (PID: 6708)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xaml | Microsoft Extensible Application Markup Language (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
27
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs wermgr.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs onedrivesetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
932"C:\WINDOWS\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\EdgeUpdate /v DoNotUpdateToEdgeWithChromium /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2076"C:\WINDOWS\system32\reg.exe" add HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdateDev /v AllowUninstall /t REG_SZ /fC:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
4300"C:\WINDOWS\SysWOW64\OneDriveSetup.exe" /uninstall C:\Windows\SysWOW64\OneDriveSetup.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneDrive (32 bit) Setup
Version:
19.043.0304.0013
Modules
Images
c:\windows\syswow64\onedrivesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6152"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\Winhance.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6160\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6180"C:\WINDOWS\system32\reg.exe" load HKU\S-1-5-21-1693682860-607145093-2874071422-500 C:\Users\Administrator\NTUSER.DATC:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
6244"C:\WINDOWS\system32\cmd.exe" /c "reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView" /f >nul 2>&1"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6320reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView" /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
6340"C:\WINDOWS\system32\cmd.exe" /c C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 561
Read events
21 444
Write events
28
Delete events
89

Modification events

(PID) Process:(932) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:DoNotUpdateToEdgeWithChromium
Value:
1
(PID) Process:(2076) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdateDev
Operation:writeName:AllowUninstall
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete keyName:(default)
Value:
(PID) Process:(6932) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete keyName:(default)
Value:
Executable files
6
Suspicious files
20
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
6152powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B7OJRJORVB896JACRJS2.tempbinary
MD5:F492B1DD82C85522ADE909A8A2649800
SHA256:A09130191C337F7F7F2D404B13C678A9F769FF704A155611BC4EE0128ABDA4E1
6152powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF135c5c.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6588csc.exeC:\Users\admin\AppData\Local\Temp\2npisq3i.outtext
MD5:28F156ECB8B301F29BFD854302D85EEE
SHA256:13079DD127DB9FD90BB8EDAAB42F5075A17720733F70F8DC1AE358AF277F34B4
6588csc.exeC:\Users\admin\AppData\Local\Temp\2npisq3i.dllexecutable
MD5:9CD06C4AE96507F30C58A0740978BA99
SHA256:4479DE8E05B743CACEB937A8A322306E8E50D70E109C2979DB756562A898468A
6716cvtres.exeC:\Users\admin\AppData\Local\Temp\RES7255.tmpbinary
MD5:FC3E179F0BF285945C6906251D2B9660
SHA256:FBC915A91D4E884BDD99463B4D282AB1E4055C011A8985B7B5692B90346A43FA
6152powershell.exeC:\Users\admin\AppData\Local\Temp\2npisq3i.0.cstext
MD5:0E2CDC2657BE537834C77429EC55CF02
SHA256:3817813F399AD49DA2ED1F1FF3B044D8E80934C6E83E9FFFE06E6ECDFE1195AE
6588csc.exeC:\Users\admin\AppData\Local\Temp\CSC3AAEB1ED5E754C369B56A4317FDFB6.TMPbinary
MD5:F038C5A382CEDC499BBCAF139C9ED6D8
SHA256:67DA6B47714E07964FBD99A7EFC35110DA927D79E90EF84D11A9F336B4AC73CB
6152powershell.exeC:\Users\admin\AppData\Local\Temp\2npisq3i.cmdlinetext
MD5:848ED170DFB17E3FC3B27A35F6810B81
SHA256:F857AC6D21976F177F42271C51E11FAB11082CB0B43C1B63EE6B9C1EC9E3525F
6152powershell.exeC:\Users\admin\AppData\Local\Temp\2qz1xlwz.0.cstext
MD5:192212FD8703F800C49BA96F01932522
SHA256:319AF060598B22FCEA608F61EF06539A09578B4AA8CAF3DFD1F5619A3D9F33CC
6152powershell.exeC:\Users\admin\AppData\Local\Temp\2qz1xlwz.cmdlinetext
MD5:124AD005197D5AE375E5872D9F8D0C16
SHA256:839D984563C53E0233365B1FC55FD52DE18630B658CD1D8B38DF8D05FD21EF9B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
36
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
104.124.11.187:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.45.69.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.52.56.216:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.52.56.216:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6012
SIHClient.exe
GET
200
2.19.101.47:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6012
SIHClient.exe
GET
200
2.19.101.47:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5536
backgroundTaskHost.exe
GET
200
23.52.56.216:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6908
wermgr.exe
GET
200
2.19.101.47:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6908
wermgr.exe
GET
200
104.124.11.187:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.124.11.187:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.45.69.233:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5064
SearchApp.exe
2.19.193.73:443
www.bing.com
Akamai International B.V.
TR
whitelisted
—
—
23.52.56.216:80
ocsp.digicert.com
AKAMAI-AS
NL
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1076
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 104.124.11.187
  • 104.124.11.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.microsoft.com
  • 23.45.69.233
  • 2.19.101.47
whitelisted
www.bing.com
  • 2.19.193.73
  • 2.19.193.137
  • 2.19.193.67
  • 2.19.193.18
  • 2.19.193.16
  • 2.19.193.99
  • 2.19.193.75
  • 2.19.193.106
  • 2.19.193.112
whitelisted
ocsp.digicert.com
  • 23.52.56.216
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.65
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.131
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Winhance.ps1