Use a trigger to try to only start a handler after the malicious file has been requested