value:  Gazer can establish persistence by setting the value “Shell” with “explorer.exe %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon. 
name: Boot or Logon Autostart Execution: Winlogon Helper Dll