# Malware Note ## main - [恶意软件学习笔记](https://docs.qwqdanchun.com/main/undefined.md) - [服务](https://docs.qwqdanchun.com/main/persistence/service.md) - [新建服务](https://docs.qwqdanchun.com/main/persistence/service/new-service.md) - [修改服务](https://docs.qwqdanchun.com/main/persistence/service/edit-service.md) - [隐藏服务](https://docs.qwqdanchun.com/main/persistence/service/hide-service.md) - [劫持服务](https://docs.qwqdanchun.com/main/persistence/service/hijack-service.md) - [启动项](https://docs.qwqdanchun.com/main/persistence/startup.md) - [注册表](https://docs.qwqdanchun.com/main/persistence/startup/registry.md) - [文件夹](https://docs.qwqdanchun.com/main/persistence/startup/folder.md) - [用户账户](https://docs.qwqdanchun.com/main/persistence/user.md) - [新建用户](https://docs.qwqdanchun.com/main/persistence/user/add-user.md) - [隐藏用户](https://docs.qwqdanchun.com/main/persistence/user/hide-user.md) - [DLL劫持](https://docs.qwqdanchun.com/main/persistence/dll-hijack.md) - [劫持自启动程序](https://docs.qwqdanchun.com/main/persistence/dll-hijack/hijack-autorun-programs.md) - [劫持.NET程序](https://docs.qwqdanchun.com/main/persistence/dll-hijack/hijack-.net-program.md) - [COM劫持](https://docs.qwqdanchun.com/main/persistence/com-hijack.md) - [COM劫持](https://docs.qwqdanchun.com/main/persistence/com-hijack/com-hijack.md) - [映像劫持](https://docs.qwqdanchun.com/main/persistence/image-file-execution-options.md) - [映像劫持](https://docs.qwqdanchun.com/main/persistence/image-file-execution-options/image-file-execution-options.md) - [计划任务](https://docs.qwqdanchun.com/main/persistence/schtasks.md) - [新建任务](https://docs.qwqdanchun.com/main/persistence/schtasks/add-schtasks.md) - [WMI](https://docs.qwqdanchun.com/main/persistence/wmi.md) - [WMI事件](https://docs.qwqdanchun.com/main/persistence/wmi/wmi-event.md) - [Office](https://docs.qwqdanchun.com/main/persistence/office.md) - [VSTO](https://docs.qwqdanchun.com/main/persistence/office/vsto.md) - [WLL/XLL](https://docs.qwqdanchun.com/main/persistence/office/wll-xll.md) - [模板文件](https://docs.qwqdanchun.com/main/persistence/office/macro-enabled-add-in-file.md) - [COM劫持](https://docs.qwqdanchun.com/main/persistence/office/com-hijack.md) - [BITS Jobs](https://docs.qwqdanchun.com/main/persistence/bits-jobs.md) - [BITS](https://docs.qwqdanchun.com/main/persistence/bits-jobs/bits.md) - [Rootkit](https://docs.qwqdanchun.com/main/persistence/rootkit.md) - [Rootkit](https://docs.qwqdanchun.com/main/persistence/rootkit/rootkit.md) - [未分类](https://docs.qwqdanchun.com/main/persistence/uncatelogued.md) - [Windows Telemetry](https://docs.qwqdanchun.com/main/persistence/uncatelogued/windows-telemetry.md) - [替换文件](https://docs.qwqdanchun.com/main/persistence/uncatelogued/replace-file.md) - [AppInit\_DLLs注入](https://docs.qwqdanchun.com/main/persistence/uncatelogued/appinit-dlls-inject.md) - [粘滞键](https://docs.qwqdanchun.com/main/persistence/uncatelogued/sethc.exe.md) - [cmd启动劫持](https://docs.qwqdanchun.com/main/persistence/uncatelogued/command-processor.md) - [屏幕保护](https://docs.qwqdanchun.com/main/persistence/uncatelogued/screen-save.md) - [注册SSP DLL](https://docs.qwqdanchun.com/main/persistence/uncatelogued/ssp-dll.md) - [AddMonitor](https://docs.qwqdanchun.com/main/persistence/uncatelogued/addmonitor.md) - [滥用POWERSHELL配置文件](https://docs.qwqdanchun.com/main/persistence/uncatelogued/powershell-profile.md) - [W32Time](https://docs.qwqdanchun.com/main/persistence/uncatelogued/w32time.md) - [UWP](https://docs.qwqdanchun.com/main/persistence/uncatelogued/uwp.md) - [Waitfor](https://docs.qwqdanchun.com/main/persistence/uncatelogued/waitfor.md) - [Bios](https://docs.qwqdanchun.com/main/persistence/uncatelogued/bios.md) - [劫持更新程序](https://docs.qwqdanchun.com/main/persistence/uncatelogued/hijack-update-program.md) - [利用LAPS](https://docs.qwqdanchun.com/main/persistence/uncatelogued/laps.md) - [SDB文件](https://docs.qwqdanchun.com/main/persistence/uncatelogued/sdb.md) - [UAC Bypass](https://docs.qwqdanchun.com/main/privilege-escalation/untitled-4.md) - [漏洞](https://docs.qwqdanchun.com/main/privilege-escalation/bug.md) - [错误配置](https://docs.qwqdanchun.com/main/privilege-escalation/wrong-config.md) - [WMI](https://docs.qwqdanchun.com/main/lateral-movement/wmi.md) - [RPC](https://docs.qwqdanchun.com/main/lateral-movement/rpc.md) - [DCOM](https://docs.qwqdanchun.com/main/lateral-movement/dcom.md) - [HASH](https://docs.qwqdanchun.com/main/lateral-movement/hash.md) - [Kerberos tickets](https://docs.qwqdanchun.com/main/lateral-movement/kerberos-tickets.md) - [Office](https://docs.qwqdanchun.com/main/file/office.md) - [LNK](https://docs.qwqdanchun.com/main/file/lnk.md) - [钓鱼lnk](https://docs.qwqdanchun.com/main/file/lnk/phishing-lnk.md) - [PE](https://docs.qwqdanchun.com/main/file/pe.md) - [CHM](https://docs.qwqdanchun.com/main/file/chm.md) - [钓鱼chm](https://docs.qwqdanchun.com/main/file/chm/phishing-chm.md) - [注入](https://docs.qwqdanchun.com/main/inject/inject.md) - [反虚拟机/沙盒](https://docs.qwqdanchun.com/main/anti-analysis/anti-vm-sandbox.md) - [SMB](https://docs.qwqdanchun.com/main/get-password/smb.md) - [注入mstsc.exe](https://docs.qwqdanchun.com/main/get-password/inject-mstsc.exe.md) - [Mimikatz](https://docs.qwqdanchun.com/main/get-password/mimikatz.md) - [NPLogonNotify](https://docs.qwqdanchun.com/main/get-password/nplogonnotify.md) - [Tickets](https://docs.qwqdanchun.com/main/get-password/tickets.md) - [启动进程](https://docs.qwqdanchun.com/main/process/creat-new-process.md) - [关闭WD](https://docs.qwqdanchun.com/main/disable-av/disable-wd.md) - [绕过AMSI](https://docs.qwqdanchun.com/main/amsi/bypass-amsi.md) - [MiniDumpWriteDump](https://docs.qwqdanchun.com/main/dump/untitled.md) - [Shellcode](https://docs.qwqdanchun.com/main/dump/shellcode.md) - [SilentProcessExit](https://docs.qwqdanchun.com/main/dump/silentprocessexit.md) - [procdump](https://docs.qwqdanchun.com/main/dump/procdump.md) - [Task Manager/Process Explorer](https://docs.qwqdanchun.com/main/dump/task-manager-process-explorer.md) - [Sqldumper](https://docs.qwqdanchun.com/main/dump/sqldumper.md) - [comsvcs.dll](https://docs.qwqdanchun.com/main/dump/comsvcs.dll.md) - [WinPmem](https://docs.qwqdanchun.com/main/dump/winpmem.md) - [ProcessDump.exe](https://docs.qwqdanchun.com/main/dump/processdump.exe.md) - [Dumpert](https://docs.qwqdanchun.com/main/dump/dumpert.md) - [BSOD](https://docs.qwqdanchun.com/main/dump/bsod.md) - [PPLdump](https://docs.qwqdanchun.com/main/dump/ppldump.md) - [Hibernation](https://docs.qwqdanchun.com/main/dump/hibernation.md) - [Stealer](https://docs.qwqdanchun.com/main/rats/stealer.md) - [输入法](https://docs.qwqdanchun.com/main/rats/stealer/shu-ru-fa.md) - [Hidden Remote](https://docs.qwqdanchun.com/main/rats/hidden-remote.md) - [Untitled](https://docs.qwqdanchun.com/main/tools/untitled.md) - [鬼知道有什么用的小知识](https://docs.qwqdanchun.com/main/tips/some-tips.md) ## 1.0.0 - [恶意软件学习笔记](https://docs.qwqdanchun.com/master.md) - [服务](https://docs.qwqdanchun.com/persistence/service.md) - [新建服务](https://docs.qwqdanchun.com/persistence/service/new-service.md) - [修改服务](https://docs.qwqdanchun.com/persistence/service/edit-service.md) - [隐藏服务](https://docs.qwqdanchun.com/persistence/service/hide-service.md) - [劫持服务](https://docs.qwqdanchun.com/persistence/service/hijack-service.md) - [启动项](https://docs.qwqdanchun.com/persistence/startup.md) - [注册表](https://docs.qwqdanchun.com/persistence/startup/registry.md) - [文件夹](https://docs.qwqdanchun.com/persistence/startup/folder.md) - [用户账户](https://docs.qwqdanchun.com/persistence/user.md) - [新建用户](https://docs.qwqdanchun.com/persistence/user/add-user.md) - [隐藏用户](https://docs.qwqdanchun.com/persistence/user/hide-user.md) - [DLL劫持](https://docs.qwqdanchun.com/persistence/dll-hijack.md) - [劫持自启动程序](https://docs.qwqdanchun.com/persistence/dll-hijack/hijack-autorun-programs.md) - [劫持.NET程序](https://docs.qwqdanchun.com/persistence/dll-hijack/hijack-.net-program.md) - [NTFS短文件名](https://docs.qwqdanchun.com/persistence/dll-hijack/ntfs-duan-wen-jian-ming.md) - [COM劫持](https://docs.qwqdanchun.com/persistence/com-hijack.md) - [COM劫持](https://docs.qwqdanchun.com/persistence/com-hijack/com-hijack.md) - [映像劫持](https://docs.qwqdanchun.com/persistence/image-file-execution-options.md) - [映像劫持](https://docs.qwqdanchun.com/persistence/image-file-execution-options/image-file-execution-options.md) - [计划任务](https://docs.qwqdanchun.com/persistence/schtasks.md) - [新建任务](https://docs.qwqdanchun.com/persistence/schtasks/add-schtasks.md) - [WMI](https://docs.qwqdanchun.com/persistence/wmi.md) - [WMI事件](https://docs.qwqdanchun.com/persistence/wmi/wmi-event.md) - [Office](https://docs.qwqdanchun.com/persistence/office.md) - [VSTO](https://docs.qwqdanchun.com/persistence/office/vsto.md) - [WLL/XLL](https://docs.qwqdanchun.com/persistence/office/wll-xll.md) - [模板文件](https://docs.qwqdanchun.com/persistence/office/macro-enabled-add-in-file.md) - [COM劫持](https://docs.qwqdanchun.com/persistence/office/com-hijack.md) - [BITS Jobs](https://docs.qwqdanchun.com/persistence/bits-jobs.md) - [BITS](https://docs.qwqdanchun.com/persistence/bits-jobs/bits.md) - [Rootkit](https://docs.qwqdanchun.com/persistence/rootkit.md) - [Rootkit](https://docs.qwqdanchun.com/persistence/rootkit/rootkit.md) - [未分类](https://docs.qwqdanchun.com/persistence/uncatelogued.md) - [Windows Telemetry](https://docs.qwqdanchun.com/persistence/uncatelogued/windows-telemetry.md) - [替换文件](https://docs.qwqdanchun.com/persistence/uncatelogued/replace-file.md) - [AppInit\_DLLs注入](https://docs.qwqdanchun.com/persistence/uncatelogued/appinit-dlls-inject.md) - [粘滞键](https://docs.qwqdanchun.com/persistence/uncatelogued/sethc.exe.md) - [cmd启动劫持](https://docs.qwqdanchun.com/persistence/uncatelogued/command-processor.md) - [屏幕保护](https://docs.qwqdanchun.com/persistence/uncatelogued/screen-save.md) - [注册SSP DLL](https://docs.qwqdanchun.com/persistence/uncatelogued/ssp-dll.md) - [AddMonitor](https://docs.qwqdanchun.com/persistence/uncatelogued/addmonitor.md) - [滥用POWERSHELL配置文件](https://docs.qwqdanchun.com/persistence/uncatelogued/powershell-profile.md) - [W32Time](https://docs.qwqdanchun.com/persistence/uncatelogued/w32time.md) - [UWP](https://docs.qwqdanchun.com/persistence/uncatelogued/uwp.md) - [Waitfor](https://docs.qwqdanchun.com/persistence/uncatelogued/waitfor.md) - [Bios](https://docs.qwqdanchun.com/persistence/uncatelogued/bios.md) - [劫持更新程序](https://docs.qwqdanchun.com/persistence/uncatelogued/hijack-update-program.md) - [利用LAPS](https://docs.qwqdanchun.com/persistence/uncatelogued/laps.md) - [SDB文件](https://docs.qwqdanchun.com/persistence/uncatelogued/sdb.md) - [lsasrv.dll](https://docs.qwqdanchun.com/persistence/uncatelogued/lsasrv.dll.md) - [LangBarAddin](https://docs.qwqdanchun.com/persistence/uncatelogued/langbaraddin.md) - [GPO](https://docs.qwqdanchun.com/persistence/uncatelogued/gpo.md) - [SPReview.exe](https://docs.qwqdanchun.com/persistence/uncatelogued/spreview.exe.md) - [LOLBin](https://docs.qwqdanchun.com/lolbins/lolbin.md) - [Take a Test](https://docs.qwqdanchun.com/lolbins/take-a-test.md) - [createdump.exe](https://docs.qwqdanchun.com/lolbins/createdump.exe.md) - [sihclient.exe](https://docs.qwqdanchun.com/lolbins/sihclient.exe.md) - [change.exe](https://docs.qwqdanchun.com/lolbins/change.exe.md) - [ftp.exe](https://docs.qwqdanchun.com/lolbins/ftp.exe.md) - [tpmtool.exe](https://docs.qwqdanchun.com/lolbins/tpmtool.exe.md) - [tar.exe](https://docs.qwqdanchun.com/lolbins/tar.exe.md) - [curl.exe](https://docs.qwqdanchun.com/lolbins/curl.exe.md) - [IMEWDBLD.exe](https://docs.qwqdanchun.com/lolbins/imewdbld.exe.md) - [Privileges](https://docs.qwqdanchun.com/privilege-escalation/privileges.md) - [UAC Bypass](https://docs.qwqdanchun.com/privilege-escalation/untitled-4.md) - [漏洞](https://docs.qwqdanchun.com/privilege-escalation/bug.md) - [错误配置](https://docs.qwqdanchun.com/privilege-escalation/wrong-config.md) - [WMI](https://docs.qwqdanchun.com/lateral-movement/wmi.md) - [RPC](https://docs.qwqdanchun.com/lateral-movement/rpc.md) - [DCOM](https://docs.qwqdanchun.com/lateral-movement/dcom.md) - [HASH](https://docs.qwqdanchun.com/lateral-movement/hash.md) - [Kerberos tickets](https://docs.qwqdanchun.com/lateral-movement/kerberos-tickets.md) - [Office](https://docs.qwqdanchun.com/file/office.md) - [LNK](https://docs.qwqdanchun.com/file/lnk.md) - [钓鱼lnk](https://docs.qwqdanchun.com/file/lnk/phishing-lnk.md) - [PE](https://docs.qwqdanchun.com/file/pe.md) - [CHM](https://docs.qwqdanchun.com/file/chm.md) - [钓鱼chm](https://docs.qwqdanchun.com/file/chm/phishing-chm.md) - [注入](https://docs.qwqdanchun.com/inject/inject.md) - [反虚拟机/沙盒](https://docs.qwqdanchun.com/anti-analysis/anti-vm-sandbox.md) - [SMB](https://docs.qwqdanchun.com/get-password/smb.md) - [注入mstsc.exe](https://docs.qwqdanchun.com/get-password/inject-mstsc.exe.md) - [Mimikatz](https://docs.qwqdanchun.com/get-password/mimikatz.md) - [NPLogonNotify](https://docs.qwqdanchun.com/get-password/nplogonnotify.md) - [Tickets](https://docs.qwqdanchun.com/get-password/tickets.md) - [启动进程](https://docs.qwqdanchun.com/process/creat-new-process.md) - [关闭WD](https://docs.qwqdanchun.com/disable-av/disable-wd.md) - [绕过AMSI](https://docs.qwqdanchun.com/amsi/bypass-amsi.md) - [MiniDumpWriteDump](https://docs.qwqdanchun.com/dump/untitled.md) - [Shellcode](https://docs.qwqdanchun.com/dump/shellcode.md) - [SilentProcessExit](https://docs.qwqdanchun.com/dump/silentprocessexit.md) - [procdump](https://docs.qwqdanchun.com/dump/procdump.md) - [Task Manager/Process Explorer](https://docs.qwqdanchun.com/dump/task-manager-process-explorer.md) - [Sqldumper](https://docs.qwqdanchun.com/dump/sqldumper.md) - [comsvcs.dll](https://docs.qwqdanchun.com/dump/comsvcs.dll.md) - [WinPmem](https://docs.qwqdanchun.com/dump/winpmem.md) - [ProcessDump.exe](https://docs.qwqdanchun.com/dump/processdump.exe.md) - [Dumpert](https://docs.qwqdanchun.com/dump/dumpert.md) - [BSOD](https://docs.qwqdanchun.com/dump/bsod.md) - [PPLdump](https://docs.qwqdanchun.com/dump/ppldump.md) - [Hibernation](https://docs.qwqdanchun.com/dump/hibernation.md) - [Stealer](https://docs.qwqdanchun.com/rats/stealer.md) - [输入法](https://docs.qwqdanchun.com/rats/stealer/shu-ru-fa.md) - [Hidden Remote](https://docs.qwqdanchun.com/rats/hidden-remote.md) - [Untitled](https://docs.qwqdanchun.com/tools/untitled.md) - [鬼知道有什么用的小知识](https://docs.qwqdanchun.com/tips/some-tips.md)