https://isc.sans.edu/diary/More+IcedID/29116