https://arstechnica.com/security/2017/05/theres-new-evidence-tying-wcry-ransomware-worm-to-prolific-hacking-group/