https://www.antiy.com/response/HideShoveling.html, https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine