value:  Chinese-nexus apt group APT27 often abuse EWM to inject code into a different process, escalating the privileges of their malicious code to the privileges of the hijacked process. 
name: Process Injection: Extra Window Memory Injection