This INI file is parsed to determine what Comnie should do. Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL). Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&amp;f=gethostinfo.bat&amp;c=&amp; Based on network traffic witnessed, the remote C2 server was found to respond with the following information