It has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. It has also utilized the PowerShell cmdlet Get-ADComputer to collect DNS hostnames, last logon dates, and operating system information from Active Directory.