The ROKRAT samples used during the two "Evil New Year" and the "North Korean Human Rights" campaigns contained a reconnaissance phase. The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData. The "System manufacturer" value is used to identify the type of machine. The source code only considers the following machine types