easy-day-js protocal.cjs NvmProtocal Run key persistence via reg.exe
Detects the use of reg.exe to add a 'NvmProtocal' entry to the Windows Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). This behavior is indicative of a backdoor establishing persistence by scheduling the execution of node.exe with a hidden PowerShell window upon user logon.
YARA-L
