It creates the folder "\ProgramData\AuditService\" and copies the clean file "lsass.exe" (taken from "\Windows\System32\") into the folder. The tainted "services.exe" installs "\ProgramData\AuditService\lsass.exe" as an autostart Windows service named "Audit Service". When the new "lsass.exe" service autostarts, the malicious file "sspisrv.dll" sideloads in the same folder. lsass.exe" will eventually crash because of a failure to load other dependencies