Registry Ruins

Challenge Question

A Windows registry hive was pulled from a workstation that was compromised. The registry records a great deal about what happened on a machine, including programs configured to start automatically. Dig through the hive to find what the attacker ran and how they made it survive a reboot.