The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent.  The following commands were observed:  tasklist ipconfig /all  The attacker performed these two commands 33 seconds apart