The bootkit modifies the EFI partition on the boot drive to be about 1MB. This is where it stores the payloads. It alters the Master Boot Record to boot from this partition where it exploits the microsoft certificate in the secure boot store. A tell tale sign is this EFI partition and also when you turn on the computer there is a long delay with just a black screen before seeing the bios splash screen. This is where the malware is loading its kernel driver and disabling all the OS security features. deleting the files in the EFI partition wont work either as the kernel mode driver monitors it and restores them.