The source code only considers the following machine types:default:   lpString = "(Other)";               break;case 0x02: lpString = "(Unknown)";             break;case 0x03: lpString = "(Desktop)";             break;case 0x04: lpString = "(Low Profile Desktop)"; break;case 0x06: lpString = "(Mini Tower)";          break;case 0x07: lpString = "(Tower)";               break;case 0x08: lpString = "(Portable)";            break;case 0x09: lpString = "(Laptop)";              break;case 0x0A: lpString = "(Notebook)";            break;case 0x0E: lpString = "(Sub Notebook)";        break;The string format - with the () - and the considering types are exactly the same as those used in the ROKRAT samples.It's interesting to note that this reconnaissance phase was not included in the ROKRAT variant used during the "Golden Time" campaign.Brower StealerFor the first time, the ROKRAT sample used during the "North Korean Human Rights" contained a browser credentials stealer