thumbnail HijackLoader evolution: abusing genuine signing certificates