For instance, the script "/cgi-bin/nt/th" is being used to receive commands from the command-andcontrol server, usually in the form of new plugins to run on the victim's computer. The "/cgi-bin/nt/sk"