It has collected local host information by utilizing Windows commands systeminfo, fsutil, and fsinfo. It has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.