First cc.bat for reconnaissance Once the scheduled task is triggered, a previously deployed batch file, %System%cc.bat, is executed in the remote machine. Based on our telemetry, this batch file launches commands to gather system information. Among the commands executed are: powershell.exe  -command “Get-NetAdapter |select InterfaceGuid” arp  -a ipconfig  /all fsutil  fsinfo drives query  user net  […]