The Trojan will then use the following regular expression to check the HTTP response to the content upload request for the file identifier value: \”id\”:(.*) The Trojan will use this file identifier value to monitor for changes made to the file by the actor by checking for changes to the modification time of the <process ID of Trojan>.txt file