Files named Invoke-WmiCommand.ps1

167.71.178.92 · Invoke-WmiCommand.ps1

/fhlbc/PowerSploit/CodeExecution/

United States · DIGITALOCEAN-ASN

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: 23808e3ef7db94f9c70ae8eef4eae419b395fd42
SHA256: 2cdba7fab6f6fcec2e4f10fc1a45c13a6a9d26cca2ea8b8b4e15989a198618ef
14.14KB
2019-11-14 03:16:31 +0000 UTC
167.71.178.92 · Invoke-WmiCommand.ps1

/tradecraftlabs/fhlbc/PowerSploit/CodeExecution/

United States · DIGITALOCEAN-ASN

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: 23808e3ef7db94f9c70ae8eef4eae419b395fd42
SHA256: 2cdba7fab6f6fcec2e4f10fc1a45c13a6a9d26cca2ea8b8b4e15989a198618ef
14.14KB
2019-10-23 16:02:07 +0000 UTC
167.71.178.92 · Invoke-WmiCommand.ps1

/fhlbc/PowerSploit/CodeExecution/

United States · DIGITALOCEAN-ASN

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: 23808e3ef7db94f9c70ae8eef4eae419b395fd42
SHA256: 2cdba7fab6f6fcec2e4f10fc1a45c13a6a9d26cca2ea8b8b4e15989a198618ef
14.14KB
2019-11-14 03:16:31 +0000 UTC