https://isc.sans.edu/diary/Infostealer+Malware+with+Double+Extension/29354/