43/n
![](https://pbs.twimg.com/media/DybQMSsWkAIF-Kg.jpg)
1⃣Compromised a new host w/ SEADADDY
2⃣Downloaded tools to folder under %temp%
3⃣Downloaded email w/ EWS script
4⃣RAR'd the data
5⃣Uploaded the RAR archive
6⃣Sdeleted the evidence
7⃣Abandoned the host
44/n
Get real-time email alerts when new unrolls are available from this author!
Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!
1) Follow Thread Reader App on Twitter so you can easily mention us!
2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll"
@threadreaderapp unroll
You can practice here first or read more on our help page!