https://mustafanafizdurukan.github.io/posts/investigating-suspicious-powershell-execution/