performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.  performs a separate injection of its communication module into an Internet accessible process through which it performs C2.