2) Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\16). 3) Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers