https://www.reliaquest.com/blog/gootloader-infection-credential-access/