Variable Name Description   gdu Google Drive URL for downloading files to the Google Drive account   gduu Google Drive URL for uploading files to the Google Drive account   gdue Google Drive URL for updating a file on the Google Drive account   gdo2t Google Drive URL used to get the OAUTH access_token   client_id The client_id for the OAUTH application   cs The client_secret for OAUTH   r_t The refresh_token for OAUTH    Table 6 Variables used to store settings needed to use Google Drive as a C2 To obtain an OAUTH access token to authenticate to the actor provided Google account, the Trojan sends an HTTP POST request to a URL stored in the gdo2t variable with grant_type, client_id, client_secret, and refresh_token fields added to the HTTP header and in the POST data