https://labs.k7computing.com/index.php/silent-watcher-dissecting-cmimai-stealers-vbs-payload/