It has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. It has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.