Yoooo, did y'all know that certutil is basically built-in wget on Windows???
I have popped hosts that don't have invoke-webrequest so many times...
https://isc.sans.edu/forums/diary/A+Suspicious+Use+of+certutilexe/23517/