Lazarus Group has used the Windows API "ObtainUserAgentString" to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.