polonus
13
It is a randomized download and this should also be considered: http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/C2~Generic-A/detailed-analysis.aspx
The urlquery dot net report should flag this by an IDS alert,
polonus