https://blog.morphisec.com/new-jssloader-trojan-delivered-through-xll-files