<i>The malware looks for processes with with a specific DLL loaded in it and then will replace two specific bytes with other instructions, which essentially trick the process into thinking an important check has been done.</i><p>It replaced a JNZ with NOP NOP. The BAE Systems blog post has lots of techincal detail: <a href="http:&#x2F;&#x2F;baesystemsai.blogspot.co.uk&#x2F;2016&#x2F;04&#x2F;two-bytes-to-951m.html" rel="nofollow">http:&#x2F;&#x2F;baesystemsai.blogspot.co.uk&#x2F;2016&#x2F;04&#x2F;two-bytes-to-951m...</a>