part 2: https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2
part 3 should appear later today…