Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\info.datipconfig /all >> %TEMP%\info.datroute PRINT >> %TEMP%\info.datnet view >> %TEMP%\info.dattasklist >> %TEMP%\info.datnet user >> %TEMP%\info.datnet start >> %TEMP%\info.dat       This script is written to a temporary file prior to be executed