Gremlin Stealer Stores C2 URLs and Exfiltration Paths in Encrypted Resource Sections