ClipBanker persistence registry Run key with randomized value name '9Er6IIp', pointing to malware executable in Administrator's Saved Games folder.
