1) The malware opens the target service process. 2) It allocates and fills four chunks of memory inside the service process. One chunk contains the entire malware DLL code (without PE headers). Another chunk is used to copy a basic Ntdll and Kernel32 import address table. Two chunks are filled with an asynchronous procedure call (APC) routine code and a stub. 3) It opens the service thread of the service process and uses the ZwQueueApcThread native API to inject an APC