LoJax has modified the Registry key "‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’" from "‘autocheck autochk *’" to "‘autocheck autoche *’" in order to execute its payload during Windows startup.