Stop the service COMSysApp - Configure the service to autostart (to set up persistence on the system) - Modify registry keys to launch the DLL unser svchost.exe - Specify the malicious DLL path to be loaded into the svchost process. Immediately restart the service - Remove the batch files to reduce the fingerprint on the system