We’re launching free support for BYOD Android devices and looking for early feedback. Interested?
Checks for artifacts from the Floxif trojan on Windows machines.
To learn more about queries, check this guide.
SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Piriform\\Agomo%';
$base = "HKLM:\SOFTWARE\Piriform"
$searchPrefix = "HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\Agomo"
# Recursively get all registry keys under the base path
Get-ChildItem -Path $base -Recurse | ForEach-Object {
if ($_.Name -like "$searchPrefix*") {
# Open the registry key to enumerate its values.
$regKey = Get-Item -LiteralPath $_.PSPath
$valueNames = $regKey.GetValueNames()
foreach ($valName in $valueNames) {
$valData = $regKey.GetValue($valName)
$valType = $regKey.GetValueKind($valName)
if ($valName -eq "") {
$nameDisplay = "(Default)"
}
else {
$nameDisplay = $valName
}
Write-Output "Path: $($_.Name) | Name: $nameDisplay | Type: $valType | Data: $valData"
}
}
}
PowerShell commands are currently work in progress, contributions welcome.
Bash commands for macOS are currently work in progress, contributions welcome.