### Overview
Post malware execution, the attackers established persistence through scheduled tasks, allowing the Total Commander RAT to survive reboots.

### Persistence Details
- **Scheduled Tasks Creation:** The RAT created a scheduled task named "Updater" with hidden attributes, set to execute the RAT binary at startup.
- **Registry Modifications:** Registry keys were modified to maintain a low footprint on the system.

### Recommendations
- **Task Monitoring:** Implement continuous monitoring and logging of scheduled tasks to detect unauthorized modifications.
- **Registry Auditing:** Enable auditing of critical registry hives to detect unauthorized changes.