The backdoor collects the victim’s MAC address using the GetAdaptersInfo API. These IDs are then passed to the C&C server as one of the POST body parameters (MAC address is sent encrypted as discussed later