It surveys a system upon check-in to discover information in the Windows Registry with the reg query command. It has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .