The Trojan checks the modified time of the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier> + “?supportTeamDrives=true&fields=modifiedTime” The Trojan then uses the following regular expression to obtain the modified time of the file from the HTTP response, which is saved to the variable named modification_time: \”modifiedTime\”:(.*) The Trojan then uploads a second file to the Google Drive, the purpose of which is to allow the Trojan to continually write to this file as it waits for the actor to modify the first file uploaded