Command execution: The execution is performed by the ShellExecuteW() API - Listing the running processes - Cleaning the malware: The malware first removes the registry key of the service and removes the library. As the library is currently running, the deletion cannot be performed immediately