ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location "HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32".