"AfterMidnight" makes it possible for operators to dynamically load and execute malware payloads on the target machine. The main controller disguises being a self-persisting Home windows Services DLL and supplies secure execution of "Gremlins" by means of a HTTPS based Listening Put up (LP) process