Figure6

Figure6

Figure 6 – The malware posing as a system process and using version details copied from a legitimate Windows Server 2012 R2 binary