### Overview
This report, following **Alert 3**, investigates how Patchwork ensures persistence on compromised systems.

### Key Findings
- **Registry Alterations**: Modifications are made to the Windows Registry, ensuring the malware executes on startup.
- **Scheduled Tasks**: In some instances, tasks are created to periodically re-launch the malware.
- **Obfuscation Methods**: Techniques are employed to disguise these changes from standard detection tools.

### Next Steps
Focus on identifying **Credential Access** attempts, as persistent access is often followed by lateral movements within the network.