The malware will establish persistence by adding an entry to the registry. For example, the NetWire malware value under the Microsoft Run registry “ruj” points to the NetWire payload in the AppData directory