This is the exact same registry changes made by the GOP attackers to have their agent stay persistent throughout the attack.
In this case, the staged PneumaEX will be persistent.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.