The Trellix team found Sirius Backdoor behind a blank FedEx PDF. A provisioning package allows it to reinstall after a Windows reset. https://www.trellix.com/blogs/research/sirius-backdoor-fileless-campaign-fedex-invoices/