https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/

https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/