It surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. It RPC backdoors have also searched for files matching the lPH*.dll pattern.