Prior to executing BOOMMIC APT29 was observed creating persistence via a registry key for “Java Update” that would execute jucheck.exe from the directory that contained version.dll and the BOOMMIC payload. Figure 19: BOOMMIC Persistence reg  add HKCU\software\Microsoft\Windows\CurrentVersion\Run" /v "Java Update" /t REG_SZ /d "c:\users\<redacted>\appdata\local\Java\jucheck.exe""