It surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. It RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.