Danderspritz, NSA post-exploitation tool, has some interesting reconnaissance scripts, which were used in covert operati