It used the command powershell "Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -property * | findstr "Address"" to find the network information of successfully logged-in accounts to discovery addresses of other machines. It has also used multiple scanning tools to discover other machines within the same compromised network.