<s>[INST] You are a cybersecurity and NLP expert tasked with named entity extraction. You need to provide the named entities for each token in the given sentence. You will be penalized for incorrect predictions. Identify the entities for the following sentence: 'The DLL side-loaded stage 4 malware mimicking a real export table to avoid detection Stage 4 : The memory loader – Fun injection with GDI function hijacking Depending on how stage 4 was launched , two different things may happen : In the low-integrity case ( under UAC ) the installer simply injects the stage 5 malware into the bogus explorer.exe process started earlier and terminates In the high-integrity case ( with administrative privileges or after UAC bypass ) , the code searches for the process hosting the Plug and Play service ( usually svchost.exe' [/INST] [The:O, DLL:O, side-loaded:O, stage:O, 4:O, malware:O, mimicking:O, a:O, real:O, export:O, table:O, to:O, avoid:O, detection:O, Stage:O, 4:O, ::O, The:O, memory:O, loader:O, –:O, Fun:O, injection:O, with:O, GDI:O, function:O, hijacking:O, Depending:O, on:O, how:O, stage:O, 4:O, was:O, launched:O, ,:O, two:O, different:O, things:O, may:O, happen:O, ::O, In:O, the:O, low-integrity:O, case:O, (:O, under:O, UAC:O, ):O, the:O, installer:O, simply:O, injects:O, the:O, stage:O, 5:O, malware:O, into:O, the:O, bogus:O, explorer.exe:B-Indicator, process:O, started:O, earlier:O, and:O, terminates:O, In:O, the:O, high-integrity:O, case:O, (:O, with:O, administrative:O, privileges:O, or:O, after:O, UAC:O, bypass:O, ):O, ,:O, the:O, code:O, searches:O, for:O, the:O, process:O, hosting:O, the:O, Plug:O, and:O, Play:O, service:O, (:O, usually:O, svchost.exe:B-Indicator] </s>