The Trojan downloads the contents of this file by crafting an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <first file identifier> + “?alt=media” With the contents of the file downloaded, the Trojan sets the modification_time variable to the current modification time so the Trojan knows when the actor makes further changes to the file