The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files