Files named windows11pro_kvm-sql_server-express_2012.ps1

speedtest-c001.cloudclusters.io · windows11pro_kvm-sql_server-express_2012.ps1

/appinstall_vps/windows/windows11pro_kvm/sql_server/

United States · AS40676

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: a2d06267e3f3456d0b9e80e8b02282514b89f679
SHA256: 4066f9c1756e8d0ba66eda501b45e01b8d66be868c8eb5997da860bec9ca7984
application/octet-stream
8.04KB
2025-12-03 02:56:18 +0000 UTC
download.cloudclusters.io · windows11pro_kvm-sql_server-express_2012.ps1

/appinstall_vps/windows/windows11pro_kvm/sql_server/

United States · AS40676

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: a2d06267e3f3456d0b9e80e8b02282514b89f679
SHA256: 4066f9c1756e8d0ba66eda501b45e01b8d66be868c8eb5997da860bec9ca7984
application/octet-stream
8.04KB
2025-12-03 02:56:18 +0000 UTC
speedtest-c005.cloudclusters.io · windows11pro_kvm-sql_server-express_2012.ps1

/appinstall_vps/windows/windows11pro_kvm/sql_server/

United States · AS40676

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: a2d06267e3f3456d0b9e80e8b02282514b89f679
SHA256: 4066f9c1756e8d0ba66eda501b45e01b8d66be868c8eb5997da860bec9ca7984
application/octet-stream
8.04KB
2025-12-03 02:56:18 +0000 UTC
download.cloudclusters.io · windows11pro_kvm-sql_server-express_2012.ps1

/appinstall_vps/windows/windows11pro_kvm/sql_server/

United States · AS40676

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: a2d06267e3f3456d0b9e80e8b02282514b89f679
SHA256: 4066f9c1756e8d0ba66eda501b45e01b8d66be868c8eb5997da860bec9ca7984
application/octet-stream
8.04KB
2025-12-03 02:56:18 +0000 UTC
speedtest-c001.cloudclusters.io · windows11pro_kvm-sql_server-express_2012.ps1

/appinstall_vps/windows/windows11pro_kvm/sql_server/

United States · AS40676

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample
The password is "infected"

SHA1: a2d06267e3f3456d0b9e80e8b02282514b89f679
SHA256: 4066f9c1756e8d0ba66eda501b45e01b8d66be868c8eb5997da860bec9ca7984
application/octet-stream
8.04KB
2025-12-03 02:56:18 +0000 UTC