https://www.systemtek.co.uk/2017/12/ursnif-variant-using-thread-local-storage-callbacks-process-injection/