https://omid.dev/2011/04/11/zeroaccess-an-advanced-kernel-mode-rootkit/