BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList "{42aedc87-2188-41fd-b9a3-0c966feabec1}" or Microsoft WBEM New Event Subsystem "{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}" depending on the system's CPU architecture.