value:  Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence. 
name: Boot or Logon Autostart Execution: Winlogon Helper Dll