Comment by hellerbarde

If these were all EFI/UEFI machines, there is a lot more code in these preboot EFI environments than one expects. Room enough to hide this kind of payload.