Tick Tock

An employee's workstation was flagged after unusual outbound network activity was detected by the organization's monitoring systems. Initial Investigation revealed that a malicious executable had been executed on the host. Investigators managed to acquire a copy of the system's registry, before the machine was reimaged as part of the remediation process. Your task is to examine the provided registry hives and determine how the attacker maintained their presence on the system.