In each iteration of the communications loop, the Trojan will check to see if the modification time of the first file changed, and if it is not updated the Trojan will update the second file by writing the string b<unique identifier>c<5 random lowercase characters>.<C2 domain> to the file by creating an HTTP POST request to a URL structured as follows: <Google Drive URL in ‘gdue’> + <second file identifier> + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents” In one RogueRobin sample (SHA256: f1b2bc0831…), the author did not use the Google Drive URL provided by the actor when issuing the x_mode command, and instead included a  hardcoded Google Drive URL, as seen in Figure 6