https://isc.sans.edu/diary/Fileless+Powershell+Dropper/29156/