neat use of application compatibility shims by FIN7 to patch shellcode into services.exe: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html