https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/#post-126138-_feak18cweg6f