Each backdoor has a different token that is encrypted in the registry. If the incoming traffic contains a token and is in the HTTP format, the backdoor will intercept the traffic and process the command. In the version that we’ve analyzed, the installer writes the token in the registry key. We can’t trigger the backdoor without a current token, which makes the backdoor more difficult to find and analyze