A It Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a It custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.