The implanted code begins when the DLL is loaded via DLL_PROCESS_ATTACH and performs the following at the DLLMain subroutine:  The technique outlined above uses process injection via undocumented Windows NTAPI calls.