It creates the folder "\ProgramData\AuditService\" and copies the clean file "lsass.exe" (taken from "\Windows\System32\") into the folder. It also drops a malicious file, "sspisrv.dll", into the folder. The tainted "services.exe" installs "\ProgramData\AuditService\lsass.exe" as an autostart Windows service named "Audit Service". When the new "lsass.exe" service autostarts, the malicious file "sspisrv.dll" sideloads in the same folder. lsass.exe" will eventually crash because of a failure to load other dependencies. By the time of the crash, "sspisrv.dll" will already have injected malicious code into the system process "svchost.exe". The injected code is located at the entry point of the DLL and therefore gets executed as soon as the DLL loads. The injected code, which has typical backdoor capabilities, now resides in the tainted "svchost.exe