COMSysApp service is first configured to autostart and the binpath of the service is set to svchost.exe. COMSysApp service is added under the “SvcHost” key as a preliminary step to its execution in the context of svchost.exe. The malicious DLL is added as a service DLL of COMSysApp. COMSysApp service is restarted