https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/