{"owner":"shadow1ng","repo":"fscan","hasSkills":true,"totalSkillsCount":4,"totalTokensCount":20135,"categories":["anthropic-skill","plugin-manifest"],"hasMcp":false,"mcpConfig":null,"found":["SKILL.md","plugins/local/auto.json","plugins/README.md","plugins/services/README.md"],"skills":{"SKILL.md":"---\nname: fscan-agent\ndescription: 使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。\nargument-hint: <目标IP/网段> [附加参数]\nallowed-tools: Bash, Read, Agent\n---\n\n# Fscan AI Agent Skill\n\n## 工具概述\n\nFscan 是一款内网综合扫描工具，功能包括：\n- 主机存活探测（ICMP / TCP）\n- 端口扫描与服务识别\n- 漏洞检测（MS17-010、Redis 未授权等）\n- 弱口令爆破（SSH、SMB、MySQL、MSSQL、FTP、RDP 等）\n- Web 指纹识别与 POC 扫描\n- NetBIOS / SMB 信息收集\n- 本地信息收集（杀软检测、系统信息等）\n\n二进制路径：当前项目编译产物 `fscan_cli`，或系统 PATH 中的 `fscan`。\n\n## 调用格式\n\n```bash\n# AI agent 标准用法：NDJSON 输出，无人类日志干扰\nfscan -h <目标> -silent [其他参数]\n\n# 解析输出\nfscan -h 192.168.1.0/24 -silent | jq 'select(.type==\"VULN\")'\n```\n\n## 核心参数\n\n### 目标指定\n\n| 参数 | 说明 | 示例 |\n|------|------|------|\n| `-h` | 目标主机（IP / CIDR / 范围） | `-h 192.168.1.0/24` `-h 10.0.0.1-10.0.0.100` |\n| `-hf` | 从文件读取目标 | `-hf targets.txt` |\n| `-p` | 指定端口（逗号/范围） | `-p 22,80,443,445,3306` `-p 1-1000` |\n| `-ep` | 排除端口 | `-ep 25,110` |\n| `-eh` | 排除主机 | `-eh 192.168.1.1` |\n| `-u` | 指定 URL（Web 扫描） | `-u https://example.com` |\n| `-uf` | URL 文件 | `-uf urls.txt` |\n\n### 扫描控制\n\n| 参数 | 说明 | 默认值 |\n|------|------|--------|\n| `-m` | 扫描模式 | `all` |\n| `-t` | 端口扫描线程数 | `600` |\n| `-mt` | 模块线程数 | `20` |\n| `-time` | 连接超时（秒） | `3` |\n| `-gt` | 全局超时（秒，0 表示不限制） | `0` |\n| `-np` | 跳过存活检测 | `false` |\n| `-ntp` | 禁用 TCP 补充探测 | `false` |\n| `-ao` | 仅存活检测 | `false` |\n| `-nobr` | 禁用暴力破解 | `false` |\n| `-full` | 全量 POC 扫描 | `false` |\n| `-max-retries` | 最大重试次数 | `1` |\n\n### 认证\n\n| 参数 | 说明 |\n|------|------|\n| `-user` | 用户名 |\n| `-pwd` | 密码 |\n| `-usera` | 追加用户名 |\n| `-pwda` | 追加密码，支持逗号或空格分隔多个值 |\n| `-userf` | 用户名字典文件 |\n| `-pwdf` | 密码字典文件 |\n| `-domain` | 域名（SMB/WMI） |\n| `-sshkey` | SSH 私钥文件 |\n| `-hash` / `-hashf` | NTLM Hash / Hash 文件 |\n\n### 代理\n\n| 参数 | 说明 |\n|------|------|\n| `-socks5` | SOCKS5 代理 (`127.0.0.1:1080`) |\n| `-proxy` | HTTP 代理 (`http://127.0.0.1:8080`) |\n| `-iface` | 指定本地网卡 IP（VPN 场景） |\n\n### 输出\n\n| 参数 | 说明 |\n|------|------|\n| `-silent` | 静默模式：stdout 仅输出 NDJSON |\n| `-o` | 输出文件路径（默认 `result.txt`） |\n| `-f` | 输出格式：`txt` / `json` / `csv` |\n| `-no` | 禁用文件保存 |\n| `-debug` | 调试模式：日志写入 `fscan_debug.log` |\n| `-log` | 日志级别（`debug` / `info` / `base` / `error`） |\n\n### 扫描模式 `-m` 的取值\n\n| 值 | 说明 |\n|------|------|\n| `all` | 全部扫描（默认） |\n| `icmp` | 仅 ICMP 存活检测 |\n| 插件名 | 仅运行指定插件（如 `ssh`、`smb`、`ms17010`、`webtitle`） |\n\n## 服务插件列表\n\n| 插件 | 默认端口 | 功能 |\n|------|----------|------|\n| `ftp` | 21 | FTP 弱口令 |\n| `ssh` | 22 | SSH 弱口令 |\n| `telnet` | 23 | Telnet 弱口令 |\n| `smtp` | 25 | SMTP 弱口令 |\n| `findnet` | 135 | RPC 网络信息发现（NetInfo） |\n| `netbios` | 139 | NetBIOS 信息收集 |\n| `smb` | 445 | SMB 弱口令 |\n| `ms17010` | 445 | MS17-010 永恒之蓝检测 |\n| `ldap` | 389 | LDAP 弱口令 |\n| `mssql` | 1433 | MSSQL 弱口令 |\n| `oracle` | 1521 | Oracle 弱口令 |\n| `mysql` | 3306 | MySQL 弱口令 |\n| `rdp` | 3389 | RDP 弱口令 + 系统信息 |\n| `postgresql` | 5432 | PostgreSQL 弱口令 |\n| `vnc` | 5900 | VNC 弱口令 |\n| `redis` | 6379 | Redis 未授权 + 弱口令 |\n| `elasticsearch` | 9200 | ES 未授权 |\n| `mongodb` | 27017 | MongoDB 未授权 + 弱口令 |\n| `memcached` | 11211 | Memcached 未授权 |\n| `kafka` | 9092 | Kafka 未授权 |\n| `activemq` | 61616 | ActiveMQ 弱口令 |\n| `rabbitmq` | 5672 | RabbitMQ 弱口令 |\n| `cassandra` | 9042 | Cassandra 弱口令 |\n| `neo4j` | 7687 | Neo4j 弱口令 |\n| `rsync` | 873 | Rsync 未授权 |\n| `webtitle` | 80/443 | Web 标题 + 指纹识别 |\n| `webpoc` | 80/443 | Web 漏洞 POC |\n\n## 本地插件（`-local`）\n\n```bash\nfscan -local avdetect    # 杀软检测\nfscan -local systeminfo  # 系统信息收集\nfscan -local envinfo     # 环境变量信息\nfscan -local dcinfo      # 域控信息\nfscan -local fileinfo    # 敏感文件搜索\n```\n\n## NDJSON 输出 Schema（`-silent` 模式）\n\n每行一个 JSON 对象，所有字段定义：\n\n| 字段 | 类型 | 出现条件 | 说明 |\n|------|------|----------|------|\n| `type` | string | 必有 | `HOST` / `PORT` / `SERVICE` / `VULN` |\n| `target` | string | 必有 | 原始目标 `host` 或 `host:port` |\n| `status` | string | 必有 | 状态描述 |\n| `host` | string | 必有 | IP 地址 |\n| `port` | int | PORT/SERVICE/VULN | 端口号 |\n| `service` | string | SERVICE/VULN | 服务名（ssh, smb, http 等） |\n| `protocol` | string | HOST/SERVICE | 协议（ICMP, TCP, http, https） |\n| `banner` | string | SERVICE | 服务 Banner |\n| `title` | string | SERVICE (web) | 网页标题 |\n| `url` | string | SERVICE (web) | 完整 URL |\n| `vulnerability` | string | VULN | 漏洞名称 |\n| `username` | string | VULN (弱口令) | 用户名 |\n| `password` | string | VULN (弱口令) | 密码 |\n| `plugin` | string | SERVICE/VULN | 产生结果的插件名 |\n| `version` | string | SERVICE | 服务版本号 |\n| `os` | string | SERVICE | 操作系统信息 |\n\n### 输出示例\n\n```jsonl\n{\"type\":\"HOST\",\"target\":\"192.168.1.5\",\"status\":\"alive\",\"host\":\"192.168.1.5\",\"protocol\":\"ICMP\"}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":22}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":445}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:22\",\"status\":\"identified\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"banner\":\"SSH-2.0-OpenSSH_8.9p1\",\"version\":\"8.9p1\",\"plugin\":\"portscan\"}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:80\",\"status\":\"web\",\"host\":\"192.168.1.5\",\"port\":80,\"service\":\"http\",\"protocol\":\"http\",\"url\":\"http://192.168.1.5:80\",\"title\":\"Welcome\",\"plugin\":\"webtitle\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:445\",\"status\":\"MS17-010 (Windows Server 2012 R2 Standard 9600)\",\"host\":\"192.168.1.5\",\"port\":445,\"vulnerability\":\"MS17-010\",\"service\":\"smb\",\"plugin\":\"ms17010\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:22\",\"status\":\"weak_credential: root:123456\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"username\":\"root\",\"password\":\"123456\",\"plugin\":\"ssh\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:6379\",\"status\":\"Redis unauthorized\",\"host\":\"192.168.1.5\",\"port\":6379,\"vulnerability\":\"Redis unauthorized access\",\"service\":\"redis\",\"plugin\":\"redis\"}\n```\n\n### 结果产出顺序\n\n1. `HOST` — 存活探测阶段\n2. `PORT` — 端口扫描阶段（与 SERVICE 可能交错）\n3. `SERVICE` — 服务识别阶段\n4. `VULN` — 漏洞/弱口令检测阶段\n\n同一 `host:port` 可产生多条结果（PORT + SERVICE + VULN）。\n\n## 常用场景参数组合\n\n### 全网段快速扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent\n```\n\n### 跳过存活检测直接扫端口（目标明确时）\n\n```bash\nfscan -h 192.168.1.0/24 -silent -np\n```\n\n### 指定端口精确扫描\n\n```bash\nfscan -h 10.0.0.0/24 -silent -p 22,80,443,445,3389,3306,6379\n```\n\n### 仅存活探测\n\n```bash\nfscan -h 172.16.0.0/16 -silent -m icmp\n```\n\n### 低速隐蔽扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent -t 30 -time 5\n```\n\n### 通过 SOCKS5 代理扫描内网\n\n```bash\nfscan -h 10.0.0.0/24 -silent -socks5 127.0.0.1:1080\n```\n\n### 仅做弱口令检测\n\n```bash\nfscan -h 192.168.1.10 -silent -m ssh -user root -pwdf /path/to/passwords.txt\n```\n\n### Web 目标扫描\n\n```bash\nfscan -u https://target.com -silent -full\n```\n\n### 多目标文件批量扫描\n\n```bash\nfscan -hf targets.txt -silent -o results.json -f json\n```\n\n### 带调试日志的排障扫描\n\n```bash\n# NDJSON 到 stdout，debug 日志到文件，互不干扰\nfscan -h 192.168.1.0/24 -silent -debug\n# 事后查看：cat fscan_debug.log\n```\n\n## AI Agent 结果处理\n\n### Python 管道消费\n\n```python\nimport json, subprocess\n\nproc = subprocess.Popen(\n    [\"fscan\", \"-h\", \"192.168.1.0/24\", \"-silent\"],\n    stdout=subprocess.PIPE, text=True\n)\n\nhosts, services, vulns = [], [], []\nfor line in proc.stdout:\n    r = json.loads(line)\n    if r[\"type\"] == \"HOST\":\n        hosts.append(r[\"host\"])\n    elif r[\"type\"] == \"SERVICE\":\n        services.append(r)\n    elif r[\"type\"] == \"VULN\":\n        vulns.append(r)\n\nproc.wait()\n```\n\n### jq 过滤\n\n```bash\n# 提取所有弱口令\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.username != null) | \"\\(.host):\\(.port) \\(.service) \\(.username):\\(.password)\"'\n\n# 提取所有漏洞\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"VULN\") | \"\\(.host):\\(.port) \\(.vulnerability)\"'\n\n# 提取 Web 服务\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.url != null) | \"\\(.url) \\(.title)\"'\n\n# 统计开放端口\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"PORT\") | .port' | sort -n | uniq -c | sort -rn\n```\n\n## 注意事项\n\n- `-silent` 抑制所有人类可读日志，stdout 仅输出 NDJSON\n- 空字段不出现在 JSON 中（`omitempty`）\n- 进程退出码 `0` 正常完成，非 `0` 表示参数错误或初始化失败\n- `-silent` 和 `-debug` 可同时使用，互不干扰\n- SOCKS5 代理下 fscan 信任协议层连接结果，不做额外深度验证\n- 扫描大网段时线程数会自动调整，资源耗尽时自适应降级\n- 默认超时 3 秒，防火墙 drop 的端口会静默超时，不计入失败率\n","plugins/local/auto.json":"{\n    \"ALYac\": {\n        \"processes\": [\n            \"aylaunch.exe\",\n            \"ayupdate2.exe\",\n            \"AYRTSrv.exe\",\n            \"AYAgent.exe\"\n        ],\n        \"url\": \"https://en.estsecurity.com/\"\n    },\n    \"AVG\": {\n        \"processes\": [\n            \"AVGSvc.exe\",\n            \"AVGUI.exe\",\n            \"avgwdsvc.exe\",\n            \"avg.exe\",\n            \"avgaurd.exe\",\n            \"avgemc.exe\",\n            \"avgrsx.exe\",\n            \"avgserv.exe\",\n            \"avgw.exe\"\n        ],\n        \"url\": \"https://www.avg.com/\"\n    },\n    \"Acronis\": {\n        \"processes\": [\n            \"arsm.exe\",\n            \"acronis_license_service.exe\"\n        ],\n        \"url\": \"https://www.acronis.com/\"\n    },\n    \"Ad-Aware\": {\n        \"processes\": [\n            \"AdAwareService.exe\",\n            \"Ad-Aware.exe\",\n            \"AdAware.exe\"\n        ],\n        \"url\": \"https://www.adaware.com/\"\n    },\n    \"AhnLab-V3\": {\n        \"processes\": [\n            \"patray.exe\",\n            \"V3Svc.exe\"\n        ],\n        \"url\": \"https://global.ahnlab.com/site/main.do\"\n    },\n    \"Arcabit\": {\n        \"processes\": [\n            \"arcavir.exe\",\n            \"arcadc.exe\",\n            \"ArcaVirMaster.exe\",\n            \"ArcaMainSV.exe\",\n            \"ArcaTasksService.exe\"\n        ],\n        \"url\": \"https://www.arcabit.pl\"\n    },\n    \"Avast\": {\n        \"processes\": [\n            \"ashDisp.exe\",\n            \"AvastUI.exe\",\n            \"AvastSvc.exe\",\n            \"AvastBrowser.exe\",\n            \"AfwServ.exe\"\n        ],\n        \"url\": \"https://www.avast.com\"\n    },\n    \"Avira AntiVirus(小红伞)\": {\n        \"processes\": [\n            \"avcenter.exe\",\n            \"avguard.exe\",\n            \"avgnt.exe\",\n            \"sched.exe\"\n        ],\n        \"url\": \"https://www.avira.com/\"\n    },\n    \"Baidu AntiVirus\": {\n        \"processes\": [\n            \"BaiduSdSvc.exe\",\n            \"BaiduSdTray.exe\",\n            \"BaiduSd.exe\",\n            \"bddownloader.exe\",\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"https://anquan.baidu.com/\"\n    },\n    \"BitDefender\": {\n        \"processes\": [\n            \"Bdagent.exe\",\n            \"BitDefenderCom.exe\",\n            \"vsserv.exe\",\n            \"bdredline.exe\",\n            \"secenter.exe\",\n            \"bdservicehost.exe\",\n            \"BITDEFENDER.exe\"\n        ],\n        \"url\": \"http://www.bitdefender.com/\"\n    },\n    \"Bkav\": {\n        \"processes\": [\n            \"BKavService.exe\",\n            \"Bka.exe\",\n            \"BkavUtil.exe\",\n            \"BLuPro.exe\"\n        ],\n        \"url\": \"https://www.bkav.com/\"\n    },\n    \"CAT-QuickHeal\": {\n        \"processes\": [\n            \"QUHLPSVC.exe\",\n            \"onlinent.exe\",\n            \"sapissvc.exe\",\n            \"scanwscs.exe\"\n        ],\n        \"url\": \"https://www.quickheal.com/\"\n    },\n    \"CMC\": {\n        \"processes\": [\n            \"CMCTrayIcon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/\"\n    },\n    \"ClamAV\": {\n        \"processes\": [\n            \"freshclam.exe\"\n        ],\n        \"url\": \"https://www.clamav.net\"\n    },\n    \"Comodo\": {\n        \"processes\": [\n            \"cpf.exe\",\n            \"cavwp.exe\",\n            \"ccavsrv.exe\",\n            \"cmdvirth.exe\"\n        ],\n        \"url\": \"https://www.comodo.com\"\n    },\n    \"CrowdStrike Falcon(猎鹰)\": {\n        \"processes\": [\n            \"csfalconservice.exe\",\n            \"CSFalconContainer.exe\"\n        ],\n        \"url\": \"https://www.crowdstrike.com\"\n    },\n    \"Cybereason\": {\n        \"processes\": [\n            \"CybereasonRansomFree.exe\",\n            \"CybereasonRansomFreeServiceHost.exe\",\n            \"CybereasonAV.exe\"\n        ],\n        \"url\": \"https://www.cybereason.com/\"\n    },\n    \"Cylance\": {\n        \"processes\": [\n            \"CylanceSvc.exe\"\n        ],\n        \"url\": \"https://www.cylance.com\"\n    },\n    \"Cyren\": {\n        \"processes\": [\n            \"vsedsps.exe\",\n            \"vseamps.exe\",\n            \"vseqrts.exe\"\n        ],\n        \"url\": \"http://www.cyren.com/\"\n    },\n    \"DrWeb\": {\n        \"processes\": [\n            \"drwebcom.exe\",\n            \"spidernt.exe\",\n            \"drwebscd.exe\",\n            \"drweb32w.exe\",\n            \"dwengine.exes\"\n        ],\n        \"url\": \"https://www.drweb.com/\"\n    },\n    \"Elastic Security\": {\n        \"processes\": [\n            \"elastic-endpoint.exe\",\n            \"elastic-agent.exe\",\n            \"agentbeat.exe\",\n            \"winlogbeat.exe\"\n        ],\n        \"url\": \"https://www.elastic.co/endpoint-detection-response\"\n    },\n    \"ESET-NOD32\": {\n        \"processes\": [\n            \"egui.exe\",\n            \"ecls.exe\",\n            \"ekrn.exe\",\n            \"eguiProxy.exe\",\n            \"EShaSrv.exe\"\n        ],\n        \"url\": \"https://www.eset.com/us/home/antivirus/\"\n    },\n    \"Trend Micro（趋势科技）\": {\n        \"processes\": [\n            \"tmpfw.exe\",\n            \"tmlisten.exe\",\n            \"coreServiceShell.exe\",\n            \"coreFrameworkHost.exe\",\n            \"uiWatchDog.exe\",\n            \"TMLISTEN.exe\"\n        ],\n        \"url\": \"https://www.trendmicro.com\"\n    },\n    \"Emsisoft\": {\n        \"processes\": [\n            \"a2guard.exe\",\n            \"a2free.exe\",\n            \"a2service.exe\"\n        ],\n        \"url\": \"https://www.emsisoft.com/\"\n    },\n    \"Endgame\": {\n        \"processes\": [\n            \"endgame.exe\"\n        ],\n        \"url\": \"https://www.endgame.com/\"\n    },\n    \"F-Prot\": {\n        \"processes\": [\n            \"F-PROT.exe\",\n            \"FProtTray.exe\",\n            \"FPAVServer.exe\",\n            \"f-stopw.exe\",\n            \"f-prot95.exe\",\n            \"f-agnt95.exe\"\n        ],\n        \"url\": \"http://f-prot.com/\"\n    },\n    \"F-Secure\": {\n        \"processes\": [\n            \"f-secure.exe\",\n            \"fssm32.exe\",\n            \"Fsorsp64.exe\",\n            \"fsavgui.exe\",\n            \"fameh32.exe\",\n            \"fch32.exe\",\n            \"fih32.exe\",\n            \"fnrb32.exe\",\n            \"fsav32.exe\",\n            \"fsma32.exe\",\n            \"fsmb32.exe\"\n        ],\n        \"url\": \"https://www.f-secure.com\"\n    },\n    \"FireEye(火眼)\": {\n        \"processes\": [\n            \"xagtnotif.exe\",\n            \"xagt.exe\"\n        ],\n        \"url\": \"https://www.fireeye.com\"\n    },\n    \"Trellix EDR(McAfee && 火眼)\": {\n        \"processes\": [\n            \"macmnsvc.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcshield.exe\",\n            \"mctray.exe\",\n            \"mfeatp.exe\",\n            \"mfeensppl.exe\",\n            \"mfeesp.exe\",\n            \"mfefw.exe\",\n            \"mfehcs.exe\",\n            \"mfemactl.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfevtps.exe\",\n            \"mfewch.exe\",\n            \"updaterui.exe\"\n        ],\n        \"url\": \"https://www.trellix.com\"\n    },\n    \"Fortinet（飞塔）\": {\n        \"processes\": [\n            \"FortiClient.exe\",\n            \"FortiTray.exe\",\n            \"FortiScand.exe\",\n            \"FortiWF.exe\",\n            \"FortiProxy.exe\",\n            \"FortiESNAC.exe\",\n            \"FortiSSLVPNdaemon.exe\",\n            \"FortiTcs.exe\",\n            \"FctSecSvr.exe\"\n        ],\n        \"url\": \"https://fortiguard.com/\"\n    },\n    \"GData\": {\n        \"processes\": [\n            \"AVK.exe\",\n            \"avkcl.exe\",\n            \"avkpop.exe\",\n            \"avkservice.exe\",\n            \"GDScan.exe\",\n            \"AVKWCtl.exe\",\n            \"AVKProxy.exe\",\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"https://www.gdatasoftware.com/\"\n    },\n    \"Ikarus\": {\n        \"processes\": [\n            \"guardxservice.exe\",\n            \"guardxkickoff.exe\"\n        ],\n        \"url\": \"https://www.ikarussecurity.com/\"\n    },\n    \"Jiangmin\": {\n        \"processes\": [\n            \"KVFW.exe\",\n            \"KVsrvXP.exe\",\n            \"KVMonXP.exe\",\n            \"KVwsc.exe\"\n        ],\n        \"url\": \"https://www.jiangmin.com/\"\n    },\n    \"K7AntiVirus\": {\n        \"processes\": [\n            \"K7TSecurity.exe\",\n            \"K7TSMain.Exe\",\n            \"K7TSUpdT.exe\"\n        ],\n        \"url\": \"http://viruslab.k7computing.com/\"\n    },\n    \"Kaspersky(卡巴斯基)\": {\n        \"processes\": [\n            \"avp.exe\",\n            \"avpcc.exe\",\n            \"avpm.exe\",\n            \"kavpf.exe\",\n            \"kavfs.exe\",\n            \"klnagent.exe\",\n            \"kavtray.exe\",\n            \"kavfswp.exe\",\n            \"kaspersky.exe\"\n        ],\n        \"url\": \"https://www.kaspersky.com\"\n    },\n    \"Max Secure Software\": {\n        \"processes\": [\n            \"SDSystemTray.exe\",\n            \"MaxRCSystemTray.exe\",\n            \"RCSystemTray.exe\",\n            \"MaxAVPlusDM.exe\",\n            \"LiveUpdateSD.exe\"\n        ],\n        \"url\": \"https://www.maxpcsecure.com/\"\n    },\n    \"Malwarebytes\": {\n        \"processes\": [\n            \"MBAMService.exe\",\n            \"mbam.exe\",\n            \"mbamtray.exe\"\n        ],\n        \"url\": \"https://www.malwarebytes.com/\"\n    },\n    \"McAfee(迈克菲-可能为Trellix)\": {\n        \"processes\": [\n            \"Mcshield.exe\",\n            \"Tbmon.exe\",\n            \"Frameworkservice.exe\",\n            \"firesvc.exe\",\n            \"firetray.exe\",\n            \"hipsvc.exe\",\n            \"mfevtps.exe\",\n            \"mcafeefire.exe\",\n            \"shstat.exe\",\n            \"vstskmgr.exe\",\n            \"engineserver.exe\",\n            \"alogserv.exe\",\n            \"avconsol.exe\",\n            \"cmgrdian.exe\",\n            \"cpd.exe\",\n            \"mcmnhdlr.exe\",\n            \"mcvsshld.exe\",\n            \"mcvsrte.exe\",\n            \"mghtml.exe\",\n            \"mpfservice.exe\",\n            \"mpfagent.exe\",\n            \"mpftray.exe\",\n            \"vshwin32.exe\",\n            \"vsstat.exe\",\n            \"guarddog.exe\",\n            \"mfeann.exe\",\n            \"udaterui.exe\",\n            \"naprdmgr.exe\",\n            \"mctray.exe\",\n            \"fcagate.exe\",\n            \"fcag.exe\",\n            \"fcags.exe\",\n            \"fcagswd.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcamnsvc.exe\",\n            \"mctary.exe\",\n            \"mfecanary.exe\",\n            \"mfeconsole.exe\",\n            \"mfeesp.exe\",\n            \"mfefire.exe\",\n            \"mfefw.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfewc.exe\",\n            \"mfewch.exe\"\n        ],\n        \"url\": \"https://www.mcafee.com/en-us\"\n    },\n    \"Microsoft Defender(Windows Defender)\": {\n        \"processes\": [\n            \"MsMpEng.exe\",\n            \"msseces.exe\",\n            \"mssecess.exe\",\n            \"emet_agent.exe\",\n            \"emet_service.exe\",\n            \"drwatson.exe\",\n            \"MpCmdRun.exe\",\n            \"NisSrv.exe\",\n            \"MsSense.exe\",\n            \"MSASCui.exe\",\n            \"MSASCuiL.exe\",\n            \"SecurityHealthService.exe\"\n        ],\n        \"url\": \"https://www.microsoft.com/en-us/windows/comprehensive-security\"\n    },\n    \"NANO-Antivirus\": {\n        \"processes\": [\n            \"nanoav.exe\",\n            \"nanoav64.exe\",\n            \"nanoreport.exe\",\n            \"nanoreportc.exe\",\n            \"nanoreportc64.exe\",\n            \"nanorst.exe\",\n            \"nanosvc.exe\"\n        ],\n        \"url\": \"https://nano-av.com/\"\n    },\n    \"Palo Alto Networks\": {\n        \"processes\": [\n            \"PanInstaller.exe\"\n        ],\n        \"url\": \"https://www.paloaltonetworks.com/\"\n    },\n    \"Panda Security\": {\n        \"processes\": [\n            \"remupd.exe\",\n            \"apvxdwin.exe\",\n            \"pavproxy.exe\",\n            \"pavsched.exe\"\n        ],\n        \"url\": \"https://www.pandasecurity.com/\"\n    },\n    \"Qihoo-360\": {\n        \"processes\": [\n            \"360sd.exe\",\n            \"360tray.exe\",\n            \"ZhuDongFangYu.exe\",\n            \"360rp.exe\",\n            \"360rps.exe\",\n            \"360safe.exe\",\n            \"360safebox.exe\",\n            \"QHActiveDefense.exe\",\n            \"360skylarsvc.exe\",\n            \"LiveUpdate360.exe\"\n        ],\n        \"url\": \"https://sd.360.cn/\"\n    },\n    \"Rising\": {\n        \"processes\": [\n            \"RavMonD.exe\",\n            \"rfwmain.exe\",\n            \"RsMgrSvc.exe\",\n            \"RavMon.exe\"\n        ],\n        \"url\": \"http://antivirus.rising.com.cn/\"\n    },\n    \"SUPERAntiSpyware\": {\n        \"processes\": [\n            \"superantispyware.exe\",\n            \"sascore.exe\",\n            \"SAdBlock.exe\",\n            \"sabsvc.exe\"\n        ],\n        \"url\": \"http://www.superadblocker.com/\"\n    },\n    \"SecureAge APEX\": {\n        \"processes\": [\n            \"UniversalAVService.exe\",\n            \"EverythingServer.exe\",\n            \"clamd.exe\"\n        ],\n        \"url\": \"https://www.secureage.com/\"\n    },\n    \"Sophos AV\": {\n        \"processes\": [\n            \"SavProgress.exe\",\n            \"icmon.exe\",\n            \"SavMain.exe\",\n            \"SophosUI.exe\",\n            \"SophosFS.exe\",\n            \"SophosHealth.exe\",\n            \"SophosSafestore64.exe\",\n            \"SophosCleanM.exe\",\n            \"SophosFileScanner.exe\",\n            \"SophosNtpService.exe\",\n            \"SophosOsquery.exe\",\n            \"Sophos UI.exe\"\n        ],\n        \"url\": \"https://www.sophos.com/\"\n    },\n    \"TACHYON\": {\n        \"processes\": [],\n        \"url\": \"https://www.tachyonlab.com/en/index.html\"\n    },\n    \"Tencent\": {\n        \"processes\": [\n            \"QQPCRTP.exe\",\n            \"QQPCTray.exe\",\n            \"QQPCMgr.exe\",\n            \"QQPCNetFlow.exe\",\n            \"QQPCRealTimeSpeedup.exe\"\n        ],\n        \"url\": \"https://guanjia.qq.com\"\n    },\n    \"TotalDefense\": {\n        \"processes\": [\n            \"AMRT.exe\",\n            \"SWatcherSrv.exe\",\n            \"Prd.ManagementConsole.exe\"\n        ],\n        \"url\": \"https://www.totaldefense.com\"\n    },\n    \"Trapmine\": {\n        \"processes\": [\n            \"TrapmineEnterpriseService.exe\",\n            \"TrapmineEnterpriseConfig.exe\",\n            \"TrapmineDeployer.exe\",\n            \"TrapmineUpgradeService.exe\"\n        ],\n        \"url\": \"https://trapmine.com/\"\n    },\n    \"TrendMicro\": {\n        \"processes\": [\n            \"TMBMSRV.exe\",\n            \"ntrtscan.exe\",\n            \"Pop3Trap.exe\",\n            \"WebTrap.exe\",\n            \"PccNTMon.exe\"\n        ],\n        \"url\": \"http://careers.trendmicro.com.cn/\"\n    },\n    \"VIPRE\": {\n        \"processes\": [\n            \"SBAMSvc.exe\",\n            \"VipreEdgeProtection.exe\",\n            \"SBAMTray.exe\"\n        ],\n        \"url\": \"https://www.vipre.com\"\n    },\n    \"ViRobot\": {\n        \"processes\": [\n            \"vrmonnt.exe\",\n            \"vrmonsvc.exe\",\n            \"Vrproxyd.exe\"\n        ],\n        \"url\": \"http://www.hauri.net/\"\n    },\n    \"Webroot\": {\n        \"processes\": [\n            \"npwebroot.exe\",\n            \"WRSA.exe\",\n            \"spysweeperui.exe\"\n        ],\n        \"url\": \"https://www.webroot.com/us/en\"\n    },\n    \"Yandex\": {\n        \"processes\": [\n            \"Yandex.exe\",\n            \"YandexDisk.exe\",\n            \"yandesk.exe\"\n        ],\n        \"url\": \"https://yandex.com/support/common/security/antiviruses-free.html\"\n    },\n    \"Zillya\": {\n        \"processes\": [\n            \"zillya.exe\",\n            \"ZAVAux.exe\",\n            \"ZAVCore.exe\"\n        ],\n        \"url\": \"https://zillya.com\"\n    },\n    \"ZoneAlarm\": {\n        \"processes\": [\n            \"vsmon.exe\",\n            \"zapro.exe\",\n            \"zonealarm.exe\"\n        ],\n        \"url\": \"https://www.zonealarm.com/\"\n    },\n    \"Zoner\": {\n        \"processes\": [\n            \"ZPSTray.exe\"\n        ],\n        \"url\": \"https://zonerantivirus.com/\"\n    },\n    \"eGambit\": {\n        \"processes\": [\n            \"dasc.exe\",\n            \"memscan64.exe\",\n            \"dastray.exe\"\n        ],\n        \"url\": \"https://egambit.app/en/\"\n    },\n    \"eScan\": {\n        \"processes\": [\n            \"consctl.exe\",\n            \"mwaser.exe\",\n            \"avpmapp.exe\"\n        ],\n        \"url\": \"https://www.escanav.com/\"\n    },\n    \"Lavasoft\": {\n        \"processes\": [\n            \"AAWTray.exe\",\n            \"LavasoftTcpService.exe\",\n            \"AdAwareTray.exe\",\n            \"WebCompanion.exe\",\n            \"WebCompanionInstaller.exe\",\n            \"adawarebp.exe\",\n            \"ad-watch.exe\"\n        ],\n        \"url\": \"https://www.lavasoft.com/\"\n    },\n    \"The Cleaner\": {\n        \"processes\": [\n            \"cleaner8.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"VBA32\": {\n        \"processes\": [\n            \"vba32lder.exe\"\n        ],\n        \"url\": \"http://www.anti-virus.by/en/index.shtml\"\n    },\n    \"Mongoosa\": {\n        \"processes\": [\n            \"MongoosaGUI.exe\",\n            \"mongoose.exe\"\n        ],\n        \"url\": \"https://www.securitymongoose.com/\"\n    },\n    \"Coranti2012\": {\n        \"processes\": [\n            \"CorantiControlCenter32.exe\"\n        ],\n        \"url\": \"https://www.coranti.com\"\n    },\n    \"UnThreat\": {\n        \"processes\": [\n            \"UnThreat.exe\",\n            \"utsvc.exe\"\n        ],\n        \"url\": \"https://softplanet.com/UnThreat-AntiVirus\"\n    },\n    \"Shield Antivirus\": {\n        \"processes\": [\n            \"CKSoftShiedAntivirus4.exe\",\n            \"shieldtray.exe\"\n        ],\n        \"url\": \"https://shieldapps.com/supportmain/shield-antivirus-support/\"\n    },\n    \"VIRUSfighter\": {\n        \"processes\": [\n            \"AVWatchService.exe\",\n            \"vfproTray.exe\"\n        ],\n        \"url\": \"https://www.spamfighter.com/VIRUSfighter/\"\n    },\n    \"Immunet\": {\n        \"processes\": [\n            \"iptray.exe\"\n        ],\n        \"url\": \"https://www.immunet.com/index\"\n    },\n    \"PSafe\": {\n        \"processes\": [\n            \"PSafeSysTray.exe\",\n            \"PSafeCategoryFinder.exe\",\n            \"psafesvc.exe\"\n        ],\n        \"url\": \"https://www.psafe.com/\"\n    },\n    \"nProtect\": {\n        \"processes\": [\n            \"nspupsvc.exe\",\n            \"Npkcmsvc.exe\",\n            \"npnj5Agent.exe\"\n        ],\n        \"url\": \"http://nos.nprotect.com/\"\n    },\n    \"Spyware Terminator\": {\n        \"processes\": [\n            \"SpywareTerminatorShield.exe\",\n            \"SpywareTerminator.exe\"\n        ],\n        \"url\": \"http://www.spywareterminator.com/Default.aspx\"\n    },\n    \"Norton（赛门铁克）\": {\n        \"processes\": [\n            \"ccSvcHst.exe\",\n            \"rtvscan.exe\",\n            \"ccapp.exe\",\n            \"NPFMntor.exe\",\n            \"ccRegVfy.exe\",\n            \"vptray.exe\",\n            \"iamapp.exe\",\n            \"nav.exe\",\n            \"navapw32.exe\",\n            \"navapsvc.exe\",\n            \"nisum.exe\",\n            \"nmain.exe\",\n            \"nprotect.exe\",\n            \"smcGui.exe\",\n            \"ns.exe\",\n            \"nortonsecurity.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n        \"Norton V25（Avast）\": {\n        \"processes\": [\n            \"afwServ.exe\",\n            \"aswEngSrv.exe\",\n            \"aswidsagent.exe\",\n            \"AvDump.exe\",\n            \"nllToolsSvc.exe\",\n            \"NortonSvc.exe\",\n            \"wsc_proxy.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n    \"Symantec（赛门铁克）\": {\n        \"processes\": [\n            \"ccSetMgr.exe\",\n            \"ccapp.exe\",\n            \"vptray.exe\",\n            \"ccpxysvc.exe\",\n            \"cfgwiz.exe\",\n            \"smc.exe\",\n            \"symproxysvc.exe\",\n            \"vpc32.exe\",\n            \"lsetup.exe\",\n            \"luall.exe\",\n            \"lucomserver.exe\",\n            \"sbserv.exe\",\n            \"ccEvtMgr.exe\",\n            \"smcGui.exe\",\n            \"snac.exe\",\n            \"SymCorpUI.exe\",\n            \"sepWscSvc64.exe\"\n        ],\n        \"url\": \"http://www.symantec.com/\"\n    },\n    \"可牛杀毒\": {\n        \"processes\": [\n            \"knsdtray.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E5%8F%AF%E7%89%9B%E5%85%8D%E8%B4%B9%E6%9D%80%E6%AF%92%E8%BD%AF%E4%BB%B6\"\n    },\n    \"流量矿石\": {\n        \"processes\": [\n            \"Miner.exe\"\n        ],\n        \"url\": \"https://jiaoyi.yunfan.com/\"\n    },\n    \"SafeDog(安全狗)\": {\n        \"processes\": [\n            \"safedog.exe\",\n            \"SafeDogGuardCenter.exe\",\n            \"SafeDogSiteIIS.exe\",\n            \"SafeDogTray.exe\",\n            \"SafeDogServerUI.exe\",\n            \"SafeDogSiteApache.exe\",\n            \"CloudHelper.exe\",\n            \"SafeDogUpdateCenter.exe\"\n        ],\n        \"url\": \"http://www.safedog.cn/\"\n    },\n    \"木马克星\": {\n        \"processes\": [\n            \"parmor.exe\",\n            \"Iparmor.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E6%9C%A8%E9%A9%AC%E5%85%8B%E6%98%9F/2979824?fr=aladdin\"\n    },\n    \"贝壳云安全\": {\n        \"processes\": [\n            \"beikesan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"木马猎手\": {\n        \"processes\": [\n            \"TrojanHunter.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"巨盾网游安全盾\": {\n        \"processes\": [\n            \"GG.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"绿鹰安全精灵\": {\n        \"processes\": [\n            \"adam.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E7%BB%BF%E9%B9%B0%E5%AE%89%E5%85%A8%E7%B2%BE%E7%81%B5\"\n    },\n    \"超级巡警\": {\n        \"processes\": [\n            \"AST.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"墨者安全专家\": {\n        \"processes\": [\n            \"ananwidget.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"风云防火墙\": {\n        \"processes\": [\n            \"FYFireWall.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"微点主动防御\": {\n        \"processes\": [\n            \"MPMon.exe\"\n        ],\n        \"url\": \"http://www.micropoint.com.cn/\"\n    },\n    \"天网防火墙\": {\n        \"processes\": [\n            \"pfw.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"D 盾\": {\n        \"processes\": [\n            \"D_Safe_Manage.exe\",\n            \"d_manage.exe\"\n        ],\n        \"url\": \"http://www.d99net.net/\"\n    },\n    \"云锁\": {\n        \"processes\": [\n            \"yunsuo_agent_service.exe\",\n            \"yunsuo_agent_daemon.exe\"\n        ],\n        \"url\": \"https://www.yunsuo.com.cn/\"\n    },\n    \"护卫神\": {\n        \"processes\": [\n            \"HwsPanel.exe\",\n            \"hws_ui.exe\",\n            \"hws.exe\",\n            \"hwsd.exe\",\n            \"HwsHostPanel.exe\",\n            \"HwsHostMaster.exe\"\n        ],\n        \"url\": \"https://www.hws.com/\"\n    },\n    \"火绒安全\": {\n        \"processes\": [\n            \"hipstray.exe\",\n            \"wsctrl.exe\",\n            \"usysdiag.exe\",\n            \"HipsDaemon.exe\",\n            \"HipsLog.exe\",\n            \"HipsMain.exe\",\n            \"wsctrlsvc.exe\"\n        ],\n        \"url\": \"https://www.huorong.cn/\"\n    },\n    \"网络病毒克星\": {\n        \"processes\": [\n            \"WEBSCANX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"SPHINX防火墙\": {\n        \"processes\": [\n            \"SPHINX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"奇安信天擎\": {\n        \"processes\": [\n            \"TQClient.exe\",\n            \"TQTray.exe\",\n            \"QaxEngManager.exe\",\n            \"TQDefender.exe\"\n        ],\n        \"url\": \"https://www.qianxin.com/product/detail/pid/330\"\n    },\n    \"H+BEDV Datentechnik GmbH\": {\n        \"processes\": [\n            \"avwin.exe\",\n            \"avwupsrv.exe\"\n        ],\n        \"url\": \"http://www.free-av.com/\"\n    },\n    \"IBM ISS Proventia\": {\n        \"processes\": [\n            \"blackd.exe\",\n            \"rapapp.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"eEye Digital Security\": {\n        \"processes\": [\n            \"eeyeevnt.exe\",\n            \"blink.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"TamoSoft\": {\n        \"processes\": [\n            \"cv.exe\",\n            \"ent.exe\"\n        ],\n        \"url\": \"https://www.tamos.com/\"\n    },\n    \"Kerio Personal Firewall\": {\n        \"processes\": [\n            \"persfw.exe\",\n            \"wrctrl.exe\"\n        ],\n        \"url\": \"http://www.kerio.com/\"\n    },\n    \"Simplysup\": {\n        \"processes\": [\n            \"Trjscan.exe\"\n        ],\n        \"url\": \"https://www.simplysup.com/\"\n    },\n    \"PC Tools AntiVirus\": {\n        \"processes\": [\n            \"PCTAV.exe\",\n            \"pctsGui.exe\"\n        ],\n        \"url\": \"http://www.pctools.com\"\n    },\n    \"VirusBuster Professional\": {\n        \"processes\": [\n            \"vbcmserv.exe\"\n        ],\n        \"url\": \"http://www.virusbuster.hu\"\n    },\n    \"ClamWin\": {\n        \"processes\": [\n            \"ClamTray.exe\",\n            \"clamscan.exe\"\n        ],\n        \"url\": \"http://www.clamwin.com/\"\n    },\n    \"安天智甲\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kscan.exe\",\n            \"AMediumManager.exe\",\n            \"kismain.exe\"\n        ],\n        \"url\": \"https://antiy.cn/\"\n    },\n    \"CMC Endpoint Security\": {\n        \"processes\": [\n            \"CMCNECore.exe\",\n            \"cmcepagent.exe\",\n            \"cmccore.exe\",\n            \"CMCLog.exe\",\n            \"CMCFMon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/giai-phap/\"\n    },\n    \"金山毒霸\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kxescore.exe\",\n            \"kupdata.exe\",\n            \"kwsprotect64.exe\",\n            \"kislive.exe\",\n            \"knewvip.exe\",\n            \"kscan.exe\",\n            \"kxecenter.exe\",\n            \"kxemain.exe\",\n            \"KWatch.exe\",\n            \"KSafeSvc.exe\",\n            \"KSafeTray.exe\"\n        ],\n        \"url\": \"http://www.ijinshan.com/\"\n    },\n    \"Agnitum outpost (Outpost Firewall)\": {\n        \"processes\": [\n            \"outpost.exe\",\n            \"acs.exe\"\n        ],\n        \"url\": \"https://agnitum-outpost-security-suite.en.softonic.com/\"\n    },\n    \"Cynet\": {\n        \"processes\": [\n            \"CynetLauncher.exe\",\n            \"CynetDS.exe\",\n            \"CynetEPS.exe\",\n            \"CynetMS.exe\",\n            \"CynetAR.exe\",\n            \"CynetGW.exe\",\n            \"CynetSD64.exe\"\n        ],\n        \"url\": \"https://www.cynet.com/\"\n    },\n    \"金山网盾\": {\n        \"processes\": [\n            \"KSWebShield.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data安全软件客户端\": {\n        \"processes\": [\n            \"AVK.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"金山网镖\": {\n        \"processes\": [\n            \"kpfwtray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在扫1433\": {\n        \"processes\": [\n            \"1433.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在爆破\": {\n        \"processes\": [\n            \"DUB.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"发现S-U\": {\n        \"processes\": [\n            \"ServUDaemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士\": {\n        \"processes\": [\n            \"bddownloader.exe\",\n            \"baiduSafeTray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士-主进程\": {\n        \"processes\": [\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"已知杀软进程,名称暂未收录\": {\n        \"processes\": [\n            \"scan32.exe\",\n            \"mcscript.exe\",\n            \"cleanup.exe\",\n            \"cmdagent.exe\",\n            \"frminst.exe\",\n            \"mcscript_inuse.exe\",\n            \"_avp32.exe\",\n            \"_avpcc.exe\",\n            \"_avpm.exe\",\n            \"aAvgApi.exe\",\n            \"ackwin32.exe\",\n            \"advxdwin.exe\",\n            \"agentsvr.exe\",\n            \"agentw.exe\",\n            \"alertsvc.exe\",\n            \"alevir.exe\",\n            \"amon9x.exe\",\n            \"anti-trojan.exe\",\n            \"antivirus.exe\",\n            \"ants.exe\",\n            \"apimonitor.exe\",\n            \"aplica32.exe\",\n            \"arr.exe\",\n            \"atcon.exe\",\n            \"atguard.exe\",\n            \"atro55en.exe\",\n            \"atupdater.exe\",\n            \"atwatch.exe\",\n            \"au.exe\",\n            \"aupdate.exe\",\n            \"auto-protect.nav80try.exe\",\n            \"autodown.exe\",\n            \"autotrace.exe\",\n            \"autoupdate.exe\",\n            \"ave32.exe\",\n            \"avgcc32.exe\",\n            \"avgctrl.exe\",\n            \"avgserv9.exe\",\n            \"avkpop.exe\",\n            \"avkserv.exe\",\n            \"avkservice.exe\",\n            \"avltmain.exe\",\n            \"avnt.exe\",\n            \"avp32.exe\",\n            \"avpdos32.exe\",\n            \"avptc32.exe\",\n            \"avpupd.exe\",\n            \"avsched32.exe\",\n            \"avsynmgr.exe\",\n            \"avwin95.exe\",\n            \"avwinnt.exe\",\n            \"avwupd.exe\",\n            \"avwupd32.exe\",\n            \"avxmonitor9x.exe\",\n            \"avxmonitornt.exe\",\n            \"avxquar.exe\",\n            \"backweb.exe\",\n            \"bargains.exe\",\n            \"bd_professional.exe\",\n            \"beagle.exe\",\n            \"belt.exe\",\n            \"bidef.exe\",\n            \"bidserver.exe\",\n            \"bipcp.exe\",\n            \"bipcpevalsetup.exe\",\n            \"bisp.exe\",\n            \"blackice.exe\",\n            \"blss.exe\",\n            \"bootconf.exe\",\n            \"bootwarn.exe\",\n            \"borg2.exe\",\n            \"bpc.exe\",\n            \"brasil.exe\",\n            \"bs120.exe\",\n            \"bundle.exe\",\n            \"bvt.exe\",\n            \"cdp.exe\",\n            \"cfd.exe\",\n            \"cfiadmin.exe\",\n            \"cfiaudit.exe\",\n            \"cfinet.exe\",\n            \"cfinet32.exe\",\n            \"claw95.exe\",\n            \"claw95cf.exe\",\n            \"clean.exe\",\n            \"cleaner.exe\",\n            \"cleaner3.exe\",\n            \"cleanpc.exe\",\n            \"click.exe\",\n            \"cmesys.exe\",\n            \"cmon016.exe\",\n            \"connectionmonitor.exe\",\n            \"cpf9x206.exe\",\n            \"cpfnt206.exe\",\n            \"ctrl.exe\",\n            \"cwnb181.exe\",\n            \"cwntdwmo.exe\",\n            \"datemanager.exe\",\n            \"dcomx.exe\",\n            \"defalert.exe\",\n            \"defscangui.exe\",\n            \"defwatch.exe\",\n            \"deputy.exe\",\n            \"divx.exe\",\n            \"dllcache.exe\",\n            \"dllreg.exe\",\n            \"doors.exe\",\n            \"dpf.exe\",\n            \"dpfsetup.exe\",\n            \"dpps2.exe\",\n            \"drweb32.exe\",\n            \"drwebupw.exe\",\n            \"dssagent.exe\",\n            \"dvp95.exe\",\n            \"dvp95_0.exe\",\n            \"ecengine.exe\",\n            \"efpeadm.exe\",\n            \"emsw.exe\",\n            \"ent.exe\",\n            \"esafe.exe\",\n            \"escanhnt.exe\",\n            \"escanv95.exe\",\n            \"espwatch.exe\",\n            \"ethereal.exe\",\n            \"etrustcipe.exe\",\n            \"evpn.exe\",\n            \"exantivirus-cnet.exe\",\n            \"exe.avxw.exe\",\n            \"expert.exe\",\n            \"explore.exe\",\n            \"fast.exe\",\n            \"findviru.exe\",\n            \"firewall.exe\",\n            \"fp-win.exe\",\n            \"fp-win_trial.exe\",\n            \"fprot.exe\",\n            \"frw.exe\",\n            \"fsaa.exe\",\n            \"fsav.exe\",\n            \"fsav530stbyb.exe\",\n            \"fsav530wtbyb.exe\",\n            \"fsav95.exe\",\n            \"fsgk32.exe\",\n            \"fsm32.exe\",\n            \"gator.exe\",\n            \"gbmenu.exe\",\n            \"gbpoll.exe\",\n            \"generics.exe\",\n            \"gmt.exe\",\n            \"guard.exe\",\n            \"hacktracersetup.exe\",\n            \"hbinst.exe\",\n            \"hbsrv.exe\",\n            \"hotactio.exe\",\n            \"hotpatch.exe\",\n            \"htlog.exe\",\n            \"htpatch.exe\",\n            \"hwpe.exe\",\n            \"hxdl.exe\",\n            \"hxiul.exe\",\n            \"iamserv.exe\",\n            \"iamstats.exe\",\n            \"ibmasn.exe\",\n            \"ibmavsp.exe\",\n            \"icload95.exe\",\n            \"icloadnt.exe\",\n            \"icmon.exe\",\n            \"icsupp95.exe\",\n            \"icsuppnt.exe\",\n            \"idle.exe\",\n            \"iedll.exe\",\n            \"iedriver.exe\",\n            \"iface.exe\",\n            \"ifw2000.exe\",\n            \"inetlnfo.exe\",\n            \"infus.exe\",\n            \"infwin.exe\",\n            \"init.exe\",\n            \"intdel.exe\",\n            \"intren.exe\",\n            \"iomon98.exe\",\n            \"istsvc.exe\",\n            \"jammer.exe\",\n            \"jdbgmrg.exe\",\n            \"jedi.exe\",\n            \"kavlite40eng.exe\",\n            \"kavpers40eng.exe\",\n            \"kazza.exe\",\n            \"keenvalue.exe\",\n            \"kerio-pf-213-en-win.exe\",\n            \"kerio-wrl-421-en-win.exe\",\n            \"kerio-wrp-421-en-win.exe\",\n            \"kernel32.exe\",\n            \"killprocesssetup161.exe\",\n            \"launcher.exe\",\n            \"ldnetmon.exe\",\n            \"ldpro.exe\",\n            \"ldpromenu.exe\",\n            \"ldscan.exe\",\n            \"lnetinfo.exe\",\n            \"loader.exe\",\n            \"localnet.exe\",\n            \"lockdown.exe\",\n            \"lockdown2000.exe\",\n            \"lookout.exe\",\n            \"lordpe.exe\",\n            \"luau.exe\",\n            \"luinit.exe\",\n            \"luspt.exe\",\n            \"mapisvc32.exe\",\n            \"mcagent.exe\",\n            \"mctool.exe\",\n            \"mcupdate.exe\",\n            \"mfin32.exe\",\n            \"mfw2en.exe\",\n            \"mfweng3.02d30.exe\",\n            \"mgavrtcl.exe\",\n            \"mgavrte.exe\",\n            \"mgui.exe\",\n            \"minilog.exe\",\n            \"mmod.exe\",\n            \"monitor.exe\",\n            \"moolive.exe\",\n            \"mostat.exe\",\n            \"mrflux.exe\",\n            \"msapp.exe\",\n            \"msbb.exe\",\n            \"msblast.exe\",\n            \"mscache.exe\",\n            \"msccn32.exe\",\n            \"mscman.exe\",\n            \"msconfig.exe\",\n            \"msdm.exe\",\n            \"msdos.exe\",\n            \"msiexec16.exe\",\n            \"msinfo32.exe\",\n            \"mslaugh.exe\",\n            \"msmgt.exe\",\n            \"msmsgri32.exe\",\n            \"mssmmc32.exe\",\n            \"mssys.exe\",\n            \"msvxd.exe\",\n            \"mu0311ad.exe\",\n            \"mwatch.exe\",\n            \"n32scanw.exe\",\n            \"navap.navapsvc.exe\",\n            \"navdx.exe\",\n            \"navlu32.exe\",\n            \"navnt.exe\",\n            \"navstub.exe\",\n            \"navw32.exe\",\n            \"navwnt.exe\",\n            \"nc2000.exe\",\n            \"ncinst4.exe\",\n            \"ndd32.exe\",\n            \"neomonitor.exe\",\n            \"neowatchlog.exe\",\n            \"netarmor.exe\",\n            \"netd32.exe\",\n            \"netinfo.exe\",\n            \"netmon.exe\",\n            \"netscanpro.exe\",\n            \"netspyhunter-1.2.exe\",\n            \"netstat.exe\",\n            \"netutils.exe\",\n            \"nisserv.exe\",\n            \"nod32.exe\",\n            \"normist.exe\",\n            \"norton_internet_secu_3.0_407.exe\",\n            \"notstart.exe\",\n            \"npf40_tw_98_nt_me_2k.exe\",\n            \"npfmessenger.exe\",\n            \"npscheck.exe\",\n            \"npssvc.exe\",\n            \"nsched32.exe\",\n            \"nssys32.exe\",\n            \"nstask32.exe\",\n            \"nsupdate.exe\",\n            \"nt.exe\",\n            \"ntvdm.exe\",\n            \"ntxconfig.exe\",\n            \"nui.exe\",\n            \"nupgrade.exe\",\n            \"nvarch16.exe\",\n            \"nvc95.exe\",\n            \"nvsvc32.exe\",\n            \"nwinst4.exe\",\n            \"nwservice.exe\",\n            \"nwtool16.exe\",\n            \"ollydbg.exe\",\n            \"onsrvr.exe\",\n            \"optimize.exe\",\n            \"ostronet.exe\",\n            \"otfix.exe\",\n            \"outpostinstall.exe\",\n            \"outpostproinstall.exe\",\n            \"padmin.exe\",\n            \"panixk.exe\",\n            \"patch.exe\",\n            \"pavcl.exe\",\n            \"pavw.exe\",\n            \"pccwin98.exe\",\n            \"pcfwallicon.exe\",\n            \"pcip10117_0.exe\",\n            \"pcscan.exe\",\n            \"pdsetup.exe\",\n            \"periscope.exe\",\n            \"perswf.exe\",\n            \"pf2.exe\",\n            \"pfwadmin.exe\",\n            \"pgmonitr.exe\",\n            \"pingscan.exe\",\n            \"platin.exe\",\n            \"poproxy.exe\",\n            \"popscan.exe\",\n            \"portdetective.exe\",\n            \"portmonitor.exe\",\n            \"powerscan.exe\",\n            \"ppinupdt.exe\",\n            \"pptbc.exe\",\n            \"ppvstop.exe\",\n            \"prizesurfer.exe\",\n            \"prmt.exe\",\n            \"prmvr.exe\",\n            \"procdump.exe\",\n            \"processmonitor.exe\",\n            \"procexplorerv1.0.exe\",\n            \"programauditor.exe\",\n            \"proport.exe\",\n            \"protectx.exe\",\n            \"pspf.exe\",\n            \"purge.exe\",\n            \"qconsole.exe\",\n            \"qserver.exe\",\n            \"rav7.exe\",\n            \"rav7win.exe\",\n            \"rav8win32eng.exe\",\n            \"ray.exe\",\n            \"rb32.exe\",\n            \"rcsync.exe\",\n            \"realmon.exe\",\n            \"reged.exe\",\n            \"regedit.exe\",\n            \"regedt32.exe\",\n            \"rescue.exe\",\n            \"rescue32.exe\",\n            \"rrguard.exe\",\n            \"rshell.exe\",\n            \"rtvscn95.exe\",\n            \"rulaunch.exe\",\n            \"run32dll.exe\",\n            \"rundll.exe\",\n            \"rundll16.exe\",\n            \"ruxdll32.exe\",\n            \"safeweb.exe\",\n            \"sahagent.exe\",\n            \"save.exe\",\n            \"savenow.exe\",\n            \"sc.exe\",\n            \"scam32.exe\",\n            \"scan95.exe\",\n            \"scanpm.exe\",\n            \"scrscan.exe\",\n            \"serv95.exe\",\n            \"setup_flowprotector_us.exe\",\n            \"setupvameeval.exe\",\n            \"sfc.exe\",\n            \"sgssfw32.exe\",\n            \"sh.exe\",\n            \"shellspyinstall.exe\",\n            \"shn.exe\",\n            \"showbehind.exe\",\n            \"sms.exe\",\n            \"smss32.exe\",\n            \"soap.exe\",\n            \"sofi.exe\",\n            \"sperm.exe\",\n            \"spf.exe\",\n            \"spoler.exe\",\n            \"spoolcv.exe\",\n            \"spoolsv32.exe\",\n            \"spyxx.exe\",\n            \"srexe.exe\",\n            \"srng.exe\",\n            \"ss3edit.exe\",\n            \"ssg_4104.exe\",\n            \"ssgrate.exe\",\n            \"st2.exe\",\n            \"start.exe\",\n            \"stcloader.exe\",\n            \"supftrl.exe\",\n            \"support.exe\",\n            \"supporter5.exe\",\n            \"svchostc.exe\",\n            \"svchosts.exe\",\n            \"sweep95.exe\",\n            \"sweepnet.sweepsrv.sys.swnetsup.exe\",\n            \"symtray.exe\",\n            \"sysedit.exe\",\n            \"sysupd.exe\",\n            \"taskmg.exe\",\n            \"taskmo.exe\",\n            \"taumon.exe\",\n            \"tbscan.exe\",\n            \"tc.exe\",\n            \"tca.exe\",\n            \"tcm.exe\",\n            \"tds-3.exe\",\n            \"tds2-98.exe\",\n            \"tds2-nt.exe\",\n            \"teekids.exe\",\n            \"tfak.exe\",\n            \"tfak5.exe\",\n            \"tgbob.exe\",\n            \"titanin.exe\",\n            \"titaninxp.exe\",\n            \"tracert.exe\",\n            \"trickler.exe\",\n            \"trjsetup.exe\",\n            \"trojantrap3.exe\",\n            \"tsadbot.exe\",\n            \"tvmd.exe\",\n            \"tvtmd.exe\",\n            \"undoboot.exe\",\n            \"updat.exe\",\n            \"update.exe\",\n            \"upgrad.exe\",\n            \"utpost.exe\",\n            \"vbcons.exe\",\n            \"vbust.exe\",\n            \"vbwin9x.exe\",\n            \"vbwinntw.exe\",\n            \"vcsetup.exe\",\n            \"vet32.exe\",\n            \"vet95.exe\",\n            \"vettray.exe\",\n            \"vfsetup.exe\",\n            \"vir-help.exe\",\n            \"virusmdpersonalfirewall.exe\",\n            \"vnlan300.exe\",\n            \"vnpc3000.exe\",\n            \"vpc42.exe\",\n            \"vpfw30s.exe\",\n            \"vscan40.exe\",\n            \"vscenu6.02d30.exe\",\n            \"vsched.exe\",\n            \"vsecomr.exe\",\n            \"vsisetup.exe\",\n            \"vsmain.exe\",\n            \"vswin9xe.exe\",\n            \"vswinntse.exe\",\n            \"vswinperse.exe\",\n            \"w32dsm89.exe\",\n            \"w9x.exe\",\n            \"watchdog.exe\",\n            \"webdav.exe\",\n            \"wfindv32.exe\",\n            \"whoswatchingme.exe\",\n            \"wimmun32.exe\",\n            \"win-bugsfix.exe\",\n            \"win32.exe\",\n            \"win32us.exe\",\n            \"winactive.exe\",\n            \"window.exe\",\n            \"windows.exe\",\n            \"wininetd.exe\",\n            \"wininitx.exe\",\n            \"winlogin.exe\",\n            \"winmain.exe\",\n            \"winnet.exe\",\n            \"winppr32.exe\",\n            \"winrecon.exe\",\n            \"winservn.exe\",\n            \"winssk32.exe\",\n            \"winstart.exe\",\n            \"winstart001.exe\",\n            \"wintsk32.exe\",\n            \"winupdate.exe\",\n            \"wkufind.exe\",\n            \"wnad.exe\",\n            \"wnt.exe\",\n            \"wradmin.exe\",\n            \"wsbgate.exe\",\n            \"wupdater.exe\",\n            \"wupdt.exe\",\n            \"wyvernworksfirewall.exe\",\n            \"xpf202en.exe\",\n            \"zapsetup3001.exe\",\n            \"zatutor.exe\",\n            \"zonalm2601.exe\",\n            \"A2CMD.exe\",\n            \"ADVCHK.exe\",\n            \"AGB.exe\",\n            \"AKRNL.exe\",\n            \"AHPROCMONSERVER.exe\",\n            \"AIRDEFENSE.exe\",\n            \"ALERTSVC.exe\",\n            \"AVIRA.exe\",\n            \"AMON.exe\",\n            \"TROJAN.exe\",\n            \"AVZ.exe\",\n            \"ANTIVIR.exe\",\n            \"ARMOR2NET.exe\",\n            \"ASH.exeexe.exe\",\n            \"ASHENHCD.exe\",\n            \"ASHMAISV.exe\",\n            \"ASHPOPWZ.exe\",\n            \"ASHSERV.exe\",\n            \"ASHSIMPL.exe\",\n            \"ASHSKPCK.exe\",\n            \"ASHWEBSV.exe\",\n            \"ASWUPDSV.exe\",\n            \"ASWSCAN.exe\",\n            \"AVCIMAN.exe\",\n            \"AVENGINE.exe\",\n            \"AVESVC.exe\",\n            \"AVEVAL.exe\",\n            \"AVEVL32.exe\",\n            \"AVGAM.exe\",\n            \"AVGCC.exe\",\n            \"AVGCHSVX.exe\",\n            \"AVGCSRVX.exe\",\n            \"AVGNSX.exe\",\n            \"AVGCC32.exe\",\n            \"AVGCTRL.exe\",\n            \"AVGFWSRV.exe\",\n            \"AVGNTMGR.exe\",\n            \"AVGTRAY.exe\",\n            \"AVGUPSVC.exe\",\n            \"AVINITNT.exe\",\n            \"AVKSERV.exe\",\n            \"AVKSERVICE.exe\",\n            \"AVP32.exe\",\n            \"AVSERVER.exe\",\n            \"AVSCHED32.exe\",\n            \"AVSYNMGR.exe\",\n            \"AVWUPD32.exe\",\n            \"AVXMONITOR.exe\",\n            \"AVXQUAR.exe\",\n            \"BDSWITCH.exe\",\n            \"BLACKICE.exe\",\n            \"CAFIX.exe\",\n            \"CFP.exe\",\n            \"CFPCONFIG.exe\",\n            \"CFIAUDIT.exe\",\n            \"CLAMWIN.exe\",\n            \"CUREIT.exe\",\n            \"DEFWATCH.exe\",\n            \"DRVIRUS.exe\",\n            \"DRWADINS.exe\",\n            \"DRWEB.exe\",\n            \"DEFENDERDAEMON.exe\",\n            \"DWEBLLIO.exe\",\n            \"DWEBIO.exe\",\n            \"ESCANH95.exe\",\n            \"ESCANHNT.exe\",\n            \"EWIDOCTRL.exe\",\n            \"EZANTIVIRUSREGISTRATIONCHECK.exe\",\n            \"FILEMON.exe\",\n            \"FIREWALL.exe\",\n            \"FORTISCAN.exe\",\n            \"FPWIN.exe\",\n            \"FSBWSYS.exe\",\n            \"F-SCHED.exe\",\n            \"FSDFWD.exe\",\n            \"FSGK32.exe\",\n            \"FSGK32ST.exe\",\n            \"FSGUIEXE.exe\",\n            \"FSPEX.exe\",\n            \"GCASDTSERV.exe\",\n            \"GCASSERV.exe\",\n            \"GIANTANTISPYWARE.exe\",\n            \"GUARDGUI.exe\",\n            \"GUARDNT.exe\",\n            \"HREGMON.exe\",\n            \"HRRES.exe\",\n            \"HSOCKPE.exe\",\n            \"HUPDATE.exe\",\n            \"IAMSERV.exe\",\n            \"ICLOAD95.exe\",\n            \"ICLOADNT.exe\",\n            \"ICMON.exe\",\n            \"ICSSUPPNT.exe\",\n            \"ICSUPP95.exe\",\n            \"ICSUPPNT.exe\",\n            \"INETUPD.exe\",\n            \"INOCIT.exe\",\n            \"INORPC.exe\",\n            \"INORT.exe\",\n            \"INOTASK.exe\",\n            \"INOUPTNG.exe\",\n            \"IOMON98.exe\",\n            \"ISAFE.exe\",\n            \"ISATRAY.exe\",\n            \"KAV.exe\",\n            \"KAVMM.exe\",\n            \"KAVPFW.exe\",\n            \"KAVSTART.exe\",\n            \"KAVSVC.exe\",\n            \"KAVSVCUI.exe\",\n            \"KMAILMON.exe\",\n            \"MAMUTU.exe\",\n            \"MCAGENT.exe\",\n            \"MCREGWIZ.exe\",\n            \"MCUPDATE.exe\",\n            \"MINILOG.exe\",\n            \"MYAGTSVC.exe\",\n            \"MYAGTTRY.exe\",\n            \"NAVLU32.exe\",\n            \"NAVW32.exe\",\n            \"NEOWATCHLOG.exe\",\n            \"NEOWATCHTRAY.exe\",\n            \"NISSERV.exe\",\n            \"NOD32.exe\",\n            \"NORMIST.exe\",\n            \"NOTSTART.exe\",\n            \"NPAVTRAY.exe\",\n            \"NPFMSG.exe\",\n            \"NSCHED32.exe\",\n            \"NSMDTR.exe\",\n            \"NSSSERV.exe\",\n            \"NSSTRAY.exe\",\n            \"NTOS.exe\",\n            \"NTXCONFIG.exe\",\n            \"NUPGRADE.exe\",\n            \"NVCOD.exe\",\n            \"NVCTE.exe\",\n            \"NVCUT.exe\",\n            \"NWSERVICE.exe\",\n            \"OFCPFWSVC.exe\",\n            \"OPSSVC.exe\",\n            \"OP_MON.exe\",\n            \"PAVFIRES.exe\",\n            \"PAVFNSVR.exe\",\n            \"PAVKRE.exe\",\n            \"PAVPROT.exe\",\n            \"PAVPRSRV.exe\",\n            \"PAVSRV51.exe\",\n            \"PAVSS.exe\",\n            \"PCCGUIDE.exe\",\n            \"PCCIOMON.exe\",\n            \"PCCPFW.exe\",\n            \"PCCTLCOM.exe\",\n            \"PERTSK.exe\",\n            \"PERVAC.exe\",\n            \"PESTPATROL.exe\",\n            \"PNMSRV.exe\",\n            \"PREVSRV.exe\",\n            \"PREVX.exe\",\n            \"PSIMSVC.exe\",\n            \"QHONLINE.exe\",\n            \"QHONSVC.exe\",\n            \"QHWSCSVC.exe\",\n            \"QHSET.exe\",\n            \"RTVSCN95.exe\",\n            \"SALITY.exe\",\n            \"SAVADMINSERVICE.exe\",\n            \"SAVSCAN.exe\",\n            \"SCANNINGPROCESS.exe\",\n            \"SDRA64.exe\",\n            \"SDHELP.exe\",\n            \"SITECLI.exe\",\n            \"SPBBCSVC.exe\",\n            \"SPIDERCPL.exe\",\n            \"SPIDERML.exe\",\n            \"SPIDERUI.exe\",\n            \"SPYBOTSD.exe\",\n            \"SPYXX.exe\",\n            \"SS3EDIT.exe\",\n            \"STOPSIGNAV.exe\",\n            \"SWAGENT.exe\",\n            \"SWDOCTOR.exe\",\n            \"SWNETSUP.exe\",\n            \"SYMLCSVC.exe\",\n            \"SYMSPORT.exe\",\n            \"SYMWSC.exe\",\n            \"SYNMGR.exe\",\n            \"TAUMON.exe\",\n            \"TMNTSRV.exe\",\n            \"TMPROXY.exe\",\n            \"TNBUTIL.exe\",\n            \"VBA32ECM.exe\",\n            \"VBA32IFS.exe\",\n            \"VBA32LDR.exe\",\n            \"VBA32PP3.exe\",\n            \"VBSNTW.exe\",\n            \"VCRMON.exe\",\n            \"VRFWSVC.exe\",\n            \"VRRW32.exe\",\n            \"VSECOMR.exe\",\n            \"WATCHDOG.exe\",\n            \"WINSSNOTIFY.exe\",\n            \"XCOMMSVR.exe\",\n            \"ZLCLIENT.exe\",\n            \"navap.exe\",\n            \"sahagent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data文件系统实时监控\": {\n        \"processes\": [\n            \"avkwctl9.exe\",\n            \"AVKWCTL.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Anti-Virus\": {\n        \"processes\": [\n            \"SAVMAIN.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360保险箱\": {\n        \"processes\": [\n            \"safeboxTray.exe\",\n            \"360safebox.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data扫描器\": {\n        \"processes\": [\n            \"GDScan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data杀毒代理\": {\n        \"processes\": [\n            \"AVKProxy.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data备份服务\": {\n        \"processes\": [\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"亚信安全服务器深度安全防护系统\": {\n        \"processes\": [\n            \"Notifier.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云盾\": {\n        \"processes\": [\n            \"AliYunDun.exe\",\n            \"AliYunDunUpdate.exe\",\n            \"aliyun_assist_service.exe\",\n            \"/usr/local/aegis/aegis_client/\"\n        ],\n        \"url\": \"\"\n    },\n    \"腾讯云安全\": {\n        \"processes\": [\n            \"BaradAgent.exe\",\n            \"sgagent.exe\",\n            \"YDService.exe\",\n            \"YDLive.exe\",\n            \"YDEdr.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360主机卫士Web\": {\n        \"processes\": [\n            \"360WebSafe.exe\",\n            \"QHSrv.exe\",\n            \"QHWebshellGuard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"网防G01\": {\n        \"processes\": [\n            \"gov_defence_service.exe\",\n            \"gov_defence_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"云锁客户端\": {\n        \"processes\": [\n            \"PC.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Symantec Shared诺顿邮件防火墙软件\": {\n        \"processes\": [\n            \"SNDSrvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"U盘杀毒专家\": {\n        \"processes\": [\n            \"USBKiller.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天擎EDRAgent\": {\n        \"processes\": [\n            \"360EntClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360(奇安信)天擎\": {\n        \"processes\": [\n            \"360EntMisc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云-云盾\": {\n        \"processes\": [\n            \"alisecguard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos AutoUpdate Service\": {\n        \"processes\": [\n            \"ALsvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云监控\": {\n        \"processes\": [\n            \"CmsGoAgent.windows-amd64.\"\n        ],\n        \"url\": \"\"\n    },\n    \"深信服EDRAgent\": {\n        \"processes\": [\n            \"edr_agent.exe\",\n            \"edr_monitor.exe\",\n            \"edr_sec_plan.exe\"\n        ],\n        \"url\": \"https://edr.sangfor.com.cn\"\n    },\n    \"戎码翼龙 NG-EDR\": {\n        \"processes\": [\n            \"rm_service.exe\",\n            \"rm_live.exe\",\n            \"rm_tray.exe\",\n            \"rm_hips.exe\"\n        ],\n        \"url\": \"https://www.rongma.com\"\n    },\n    \"启明星辰天珣EDRAgent\": {\n        \"processes\": [\n            \"ESAV.exe\",\n            \"ESCCControl.exe\",\n            \"ESCC.exe\",\n            \"ESCCIndex.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"蓝鲸Agent\": {\n        \"processes\": [\n            \"gse_win_agent.exe\",\n            \"gse_win_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"联想电脑管家\": {\n        \"processes\": [\n            \"LAVService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Agent\": {\n        \"processes\": [\n            \"McsAgent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Client\": {\n        \"processes\": [\n            \"McsClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360TotalSecurity(360国际版)\": {\n        \"processes\": [\n            \"QHSafeMain.exe\",\n            \"QHSafeTray.exe\",\n            \"QHWatchdog.exe\",\n            \"QHActiveDefense.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Device Control Service\": {\n        \"processes\": [\n            \"sdcservice.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Endpoint Defense Service\": {\n        \"processes\": [\n            \"SEDService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Windows Defender SmartScreen\": {\n        \"processes\": [\n            \"smartscreen.exe\"\n        ],\n        \"url\": \"https://learn.microsoft.com/zh-cn/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/\"\n    },\n    \"Sophos Clean Service\": {\n        \"processes\": [\n            \"SophosCleanM64.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos FIM\": {\n        \"processes\": [\n            \"SophosFIMService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos System Protection Service\": {\n        \"processes\": [\n            \"SSPService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Web Control Service\": {\n        \"processes\": [\n            \"swc_service.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天眼云镜\": {\n        \"processes\": [\n            \"TitanAgent.exe\",\n            \"TitanMonitor.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天融信终端防御\": {\n        \"processes\": [\n            \"TopsecMain.exe\",\n            \"TopsecTray.exe\"\n        ],\n     ","plugins/README.md":"# FScan 插件开发规范\n\n## 概述\n\nFScan 采用简化的单文件插件架构，每个插件一个 `.go` 文件，消除了过度设计的多文件结构。\n\n\n1. **简洁至上**：消除所有不必要的抽象层\n2. **直击本质**：专注于解决实际问题，不为架构而架构  \n3. **向后兼容**：不破坏用户接口和现有功能\n4. **消除特殊情况**：统一处理逻辑，减少 if/else 分支\n\n## 插件架构\n\n### 核心接口\n\n```go\n// Plugin 插件接口 - 只保留必要的方法\ntype Plugin interface {\n    GetName() string                                        // 插件名称\n    GetPorts() []int                                       // 支持的端口\n    Scan(ctx context.Context, info *common.HostInfo) *ScanResult  // 扫描功能\n}\n\n// 可选接口：如果插件支持利用功能\ntype Exploiter interface {\n    Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult\n}\n```\n\n### 数据结构\n\n```go\n// ScanResult 扫描结果 - 删除所有冗余字段\ntype ScanResult struct {\n    Success  bool   // 扫描是否成功\n    Service  string // 服务类型\n    Username string // 发现的用户名（弱密码）\n    Password string // 发现的密码（弱密码）  \n    Banner   string // 服务版本信息\n    Error    error  // 错误信息（如果失败）\n}\n\n// ExploitResult 利用结果（仅有利用功能的插件需要）\ntype ExploitResult struct {\n    Success bool   // 利用是否成功\n    Output  string // 命令执行输出\n    Error   error  // 错误信息\n}\n\n// Credential 凭据结构\ntype Credential struct {\n    Username string\n    Password string\n    KeyData  []byte // SSH私钥等\n}\n```\n\n## 插件开发模板\n\n### 1. 纯扫描插件（如MySQL）\n\n```go\npackage plugins\n\nimport (\n    \"context\"\n    \"fmt\"\n    // 其他必要导入\n)\n\n// PluginName服务扫描插件\ntype PluginNamePlugin struct {\n    name  string\n    ports []int\n}\n\n// 构造函数\nfunc NewPluginNamePlugin() *PluginNamePlugin {\n    return &PluginNamePlugin{\n        name:  \"plugin_name\",\n        ports: []int{default_port},\n    }\n}\n\n// 实现Plugin接口\nfunc (p *PluginNamePlugin) GetName() string { return p.name }\nfunc (p *PluginNamePlugin) GetPorts() []int { return p.ports }\n\nfunc (p *PluginNamePlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 如果禁用暴力破解，只做服务识别\n    if common.DisableBrute {\n        return p.identifyService(info)\n    }\n\n    // 生成测试凭据\n    credentials := GenerateCredentials(\"plugin_name\")\n    \n    // 逐个测试凭据\n    for _, cred := range credentials {\n        select {\n        case <-ctx.Done():\n            return &ScanResult{Success: false, Error: ctx.Err()}\n        default:\n        }\n\n        if p.testCredential(ctx, info, cred) {\n            return &ScanResult{\n                Success:  true,\n                Service:  \"plugin_name\",\n                Username: cred.Username,\n                Password: cred.Password,\n            }\n        }\n    }\n\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 核心认证逻辑\nfunc (p *PluginNamePlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool {\n    // 实现具体的认证测试逻辑\n    return false\n}\n\n// 服务识别（-nobr模式）\nfunc (p *PluginNamePlugin) identifyService(info *common.HostInfo) *ScanResult {\n    // 实现服务识别逻辑\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 自动注册\nfunc init() {\n    RegisterPlugin(\"plugin_name\", func() Plugin {\n        return NewPluginNamePlugin()\n    })\n}\n```\n\n### 2. 带利用功能的插件（如SSH）\n\n```go\npackage plugins\n\n// SSH插件结构\ntype SSHPlugin struct {\n    name  string\n    ports []int\n}\n\n// 同时实现Plugin和Exploiter接口\nfunc (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 扫描逻辑（同上）\n}\n\nfunc (p *SSHPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult {\n    // 建立SSH连接\n    client, err := p.connectSSH(info, creds)\n    if err != nil {\n        return &ExploitResult{Success: false, Error: err}\n    }\n    defer client.Close()\n\n    // 执行命令或其他利用操作\n    output, err := p.executeCommand(client, \"whoami\")\n    return &ExploitResult{\n        Success: err == nil,\n        Output:  output,\n        Error:   err,\n    }\n}\n\n// 辅助方法\nfunc (p *SSHPlugin) connectSSH(info *common.HostInfo, creds Credential) (*ssh.Client, error) {\n    // SSH连接实现\n}\n\nfunc (p *SSHPlugin) executeCommand(client *ssh.Client, cmd string) (string, error) {\n    // 命令执行实现\n}\n```\n\n## 开发规范\n\n### 文件组织\n\n```\nplugins/\n├── base.go           # 核心接口和注册系统\n├── mysql.go          # MySQL插件\n├── ssh.go            # SSH插件  \n├── redis.go          # Redis插件\n└── README.md         # 开发文档（本文件）\n```\n\n### 命名规范\n\n- **插件文件**：`{service_name}.go`\n- **插件结构体**：`{ServiceName}Plugin`\n- **构造函数**：`New{ServiceName}Plugin()`\n- **插件名称**：小写，与文件名一致\n\n### 代码规范\n\n1. **错误处理**：始终使用Context进行超时控制\n2. **日志输出**：成功时使用 `common.LogSuccess`，调试用 `common.LogDebug`\n3. **凭据生成**：使用 `GenerateCredentials(service_name)` 生成测试凭据\n4. **资源管理**：及时关闭连接，使用 defer 确保清理\n\n### 测试要求\n\n每个插件必须支持：\n\n1. **暴力破解模式**：`common.DisableBrute = false`\n2. **服务识别模式**：`common.DisableBrute = true`\n3. **Context超时处理**：正确响应 `ctx.Done()`\n4. **代理支持**：如果 `common.Socks5Proxy` 不为空\n\n## 迁移指南\n\n### 从三文件架构迁移\n\n1. **提取核心逻辑**：从 connector.go 提取认证逻辑\n2. **合并实现**：将 plugin.go 中的组装逻辑内联\n3. **删除垃圾**：删除空的 exploiter.go\n4. **简化数据结构**：只保留必要的字段\n\n### 从Legacy插件迁移\n\n1. **保留核心逻辑**：复制扫描和认证的核心算法\n2. **标准化接口**：实现统一的Plugin接口  \n3. **移除全局依赖**：通过返回值而不是全局变量传递结果\n4. **统一日志**：使用统一的日志接口\n\n## 性能优化\n\n1. **连接复用**：在同一次扫描中复用连接\n2. **内存管理**：及时释放不需要的资源\n3. **并发控制**：通过Context控制并发度\n4. **超时设置**：合理设置各阶段超时时间\n\n## 示例\n\n参考 `mysql.go` 作为标准的纯扫描插件实现\n参考 `ssh.go` 作为带利用功能的插件实现\n\n---\n\n**记住：好的代码不是写出来的，是重构出来的。消除所有不必要的复杂性，直击问题本质。**","plugins/services/README.md":"# 服务扫描插件目录\n\n本目录包含所有服务扫描插件，采用简化的单文件插件架构。\n\n## 已实现插件\n\n### 数据库服务\n- `mysql.go` - MySQL数据库扫描\n- `postgresql.go` - PostgreSQL数据库扫描  \n- `redis.go` - Redis内存数据库扫描\n- `mongodb.go` - MongoDB文档数据库扫描\n- `mssql.go` - Microsoft SQL Server扫描\n- `oracle.go` - Oracle数据库扫描\n- `memcached.go` - Memcached缓存扫描\n- `neo4j.go` - Neo4j图数据库扫描\n\n### 消息队列服务\n- `rabbitmq.go` - RabbitMQ消息队列扫描\n- `activemq.go` - ActiveMQ消息队列扫描\n- `kafka.go` - Apache Kafka扫描\n\n### 网络服务\n- `ssh.go` - SSH远程登录服务扫描\n- `ftp.go` - FTP文件传输服务扫描\n- `telnet.go` - Telnet远程终端服务扫描\n- `smtp.go` - SMTP邮件服务扫描\n- `snmp.go` - SNMP网络管理协议扫描\n- `ldap.go` - LDAP目录服务扫描\n- `rsync.go` - Rsync文件同步服务扫描\n\n### Windows服务\n- `findnet.go` - Windows网络发现插件 (RPC端点映射)\n- `smbinfo.go` - SMB协议信息收集插件\n\n### 其他服务\n- `vnc.go` - VNC远程桌面服务扫描\n- `cassandra.go` - Apache Cassandra数据库扫描\n\n## 插件特性\n\n每个插件都包含：\n- ✅ 服务识别功能\n- ✅ 弱密码检测功能\n- ✅ 完整的利用功能\n- ✅ 错误处理和超时控制\n- ✅ 统一的结果输出格式\n\n## 开发规范\n\n所有插件都遵循 `../README.md` 中定义的开发规范。"},"files":{"SKILL.md":"---\nname: fscan-agent\ndescription: 使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。\nargument-hint: <目标IP/网段> [附加参数]\nallowed-tools: Bash, Read, Agent\n---\n\n# Fscan AI Agent Skill\n\n## 工具概述\n\nFscan 是一款内网综合扫描工具，功能包括：\n- 主机存活探测（ICMP / TCP）\n- 端口扫描与服务识别\n- 漏洞检测（MS17-010、Redis 未授权等）\n- 弱口令爆破（SSH、SMB、MySQL、MSSQL、FTP、RDP 等）\n- Web 指纹识别与 POC 扫描\n- NetBIOS / SMB 信息收集\n- 本地信息收集（杀软检测、系统信息等）\n\n二进制路径：当前项目编译产物 `fscan_cli`，或系统 PATH 中的 `fscan`。\n\n## 调用格式\n\n```bash\n# AI agent 标准用法：NDJSON 输出，无人类日志干扰\nfscan -h <目标> -silent [其他参数]\n\n# 解析输出\nfscan -h 192.168.1.0/24 -silent | jq 'select(.type==\"VULN\")'\n```\n\n## 核心参数\n\n### 目标指定\n\n| 参数 | 说明 | 示例 |\n|------|------|------|\n| `-h` | 目标主机（IP / CIDR / 范围） | `-h 192.168.1.0/24` `-h 10.0.0.1-10.0.0.100` |\n| `-hf` | 从文件读取目标 | `-hf targets.txt` |\n| `-p` | 指定端口（逗号/范围） | `-p 22,80,443,445,3306` `-p 1-1000` |\n| `-ep` | 排除端口 | `-ep 25,110` |\n| `-eh` | 排除主机 | `-eh 192.168.1.1` |\n| `-u` | 指定 URL（Web 扫描） | `-u https://example.com` |\n| `-uf` | URL 文件 | `-uf urls.txt` |\n\n### 扫描控制\n\n| 参数 | 说明 | 默认值 |\n|------|------|--------|\n| `-m` | 扫描模式 | `all` |\n| `-t` | 端口扫描线程数 | `600` |\n| `-mt` | 模块线程数 | `20` |\n| `-time` | 连接超时（秒） | `3` |\n| `-gt` | 全局超时（秒，0 表示不限制） | `0` |\n| `-np` | 跳过存活检测 | `false` |\n| `-ntp` | 禁用 TCP 补充探测 | `false` |\n| `-ao` | 仅存活检测 | `false` |\n| `-nobr` | 禁用暴力破解 | `false` |\n| `-full` | 全量 POC 扫描 | `false` |\n| `-max-retries` | 最大重试次数 | `1` |\n\n### 认证\n\n| 参数 | 说明 |\n|------|------|\n| `-user` | 用户名 |\n| `-pwd` | 密码 |\n| `-usera` | 追加用户名 |\n| `-pwda` | 追加密码，支持逗号或空格分隔多个值 |\n| `-userf` | 用户名字典文件 |\n| `-pwdf` | 密码字典文件 |\n| `-domain` | 域名（SMB/WMI） |\n| `-sshkey` | SSH 私钥文件 |\n| `-hash` / `-hashf` | NTLM Hash / Hash 文件 |\n\n### 代理\n\n| 参数 | 说明 |\n|------|------|\n| `-socks5` | SOCKS5 代理 (`127.0.0.1:1080`) |\n| `-proxy` | HTTP 代理 (`http://127.0.0.1:8080`) |\n| `-iface` | 指定本地网卡 IP（VPN 场景） |\n\n### 输出\n\n| 参数 | 说明 |\n|------|------|\n| `-silent` | 静默模式：stdout 仅输出 NDJSON |\n| `-o` | 输出文件路径（默认 `result.txt`） |\n| `-f` | 输出格式：`txt` / `json` / `csv` |\n| `-no` | 禁用文件保存 |\n| `-debug` | 调试模式：日志写入 `fscan_debug.log` |\n| `-log` | 日志级别（`debug` / `info` / `base` / `error`） |\n\n### 扫描模式 `-m` 的取值\n\n| 值 | 说明 |\n|------|------|\n| `all` | 全部扫描（默认） |\n| `icmp` | 仅 ICMP 存活检测 |\n| 插件名 | 仅运行指定插件（如 `ssh`、`smb`、`ms17010`、`webtitle`） |\n\n## 服务插件列表\n\n| 插件 | 默认端口 | 功能 |\n|------|----------|------|\n| `ftp` | 21 | FTP 弱口令 |\n| `ssh` | 22 | SSH 弱口令 |\n| `telnet` | 23 | Telnet 弱口令 |\n| `smtp` | 25 | SMTP 弱口令 |\n| `findnet` | 135 | RPC 网络信息发现（NetInfo） |\n| `netbios` | 139 | NetBIOS 信息收集 |\n| `smb` | 445 | SMB 弱口令 |\n| `ms17010` | 445 | MS17-010 永恒之蓝检测 |\n| `ldap` | 389 | LDAP 弱口令 |\n| `mssql` | 1433 | MSSQL 弱口令 |\n| `oracle` | 1521 | Oracle 弱口令 |\n| `mysql` | 3306 | MySQL 弱口令 |\n| `rdp` | 3389 | RDP 弱口令 + 系统信息 |\n| `postgresql` | 5432 | PostgreSQL 弱口令 |\n| `vnc` | 5900 | VNC 弱口令 |\n| `redis` | 6379 | Redis 未授权 + 弱口令 |\n| `elasticsearch` | 9200 | ES 未授权 |\n| `mongodb` | 27017 | MongoDB 未授权 + 弱口令 |\n| `memcached` | 11211 | Memcached 未授权 |\n| `kafka` | 9092 | Kafka 未授权 |\n| `activemq` | 61616 | ActiveMQ 弱口令 |\n| `rabbitmq` | 5672 | RabbitMQ 弱口令 |\n| `cassandra` | 9042 | Cassandra 弱口令 |\n| `neo4j` | 7687 | Neo4j 弱口令 |\n| `rsync` | 873 | Rsync 未授权 |\n| `webtitle` | 80/443 | Web 标题 + 指纹识别 |\n| `webpoc` | 80/443 | Web 漏洞 POC |\n\n## 本地插件（`-local`）\n\n```bash\nfscan -local avdetect    # 杀软检测\nfscan -local systeminfo  # 系统信息收集\nfscan -local envinfo     # 环境变量信息\nfscan -local dcinfo      # 域控信息\nfscan -local fileinfo    # 敏感文件搜索\n```\n\n## NDJSON 输出 Schema（`-silent` 模式）\n\n每行一个 JSON 对象，所有字段定义：\n\n| 字段 | 类型 | 出现条件 | 说明 |\n|------|------|----------|------|\n| `type` | string | 必有 | `HOST` / `PORT` / `SERVICE` / `VULN` |\n| `target` | string | 必有 | 原始目标 `host` 或 `host:port` |\n| `status` | string | 必有 | 状态描述 |\n| `host` | string | 必有 | IP 地址 |\n| `port` | int | PORT/SERVICE/VULN | 端口号 |\n| `service` | string | SERVICE/VULN | 服务名（ssh, smb, http 等） |\n| `protocol` | string | HOST/SERVICE | 协议（ICMP, TCP, http, https） |\n| `banner` | string | SERVICE | 服务 Banner |\n| `title` | string | SERVICE (web) | 网页标题 |\n| `url` | string | SERVICE (web) | 完整 URL |\n| `vulnerability` | string | VULN | 漏洞名称 |\n| `username` | string | VULN (弱口令) | 用户名 |\n| `password` | string | VULN (弱口令) | 密码 |\n| `plugin` | string | SERVICE/VULN | 产生结果的插件名 |\n| `version` | string | SERVICE | 服务版本号 |\n| `os` | string | SERVICE | 操作系统信息 |\n\n### 输出示例\n\n```jsonl\n{\"type\":\"HOST\",\"target\":\"192.168.1.5\",\"status\":\"alive\",\"host\":\"192.168.1.5\",\"protocol\":\"ICMP\"}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":22}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":445}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:22\",\"status\":\"identified\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"banner\":\"SSH-2.0-OpenSSH_8.9p1\",\"version\":\"8.9p1\",\"plugin\":\"portscan\"}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:80\",\"status\":\"web\",\"host\":\"192.168.1.5\",\"port\":80,\"service\":\"http\",\"protocol\":\"http\",\"url\":\"http://192.168.1.5:80\",\"title\":\"Welcome\",\"plugin\":\"webtitle\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:445\",\"status\":\"MS17-010 (Windows Server 2012 R2 Standard 9600)\",\"host\":\"192.168.1.5\",\"port\":445,\"vulnerability\":\"MS17-010\",\"service\":\"smb\",\"plugin\":\"ms17010\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:22\",\"status\":\"weak_credential: root:123456\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"username\":\"root\",\"password\":\"123456\",\"plugin\":\"ssh\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:6379\",\"status\":\"Redis unauthorized\",\"host\":\"192.168.1.5\",\"port\":6379,\"vulnerability\":\"Redis unauthorized access\",\"service\":\"redis\",\"plugin\":\"redis\"}\n```\n\n### 结果产出顺序\n\n1. `HOST` — 存活探测阶段\n2. `PORT` — 端口扫描阶段（与 SERVICE 可能交错）\n3. `SERVICE` — 服务识别阶段\n4. `VULN` — 漏洞/弱口令检测阶段\n\n同一 `host:port` 可产生多条结果（PORT + SERVICE + VULN）。\n\n## 常用场景参数组合\n\n### 全网段快速扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent\n```\n\n### 跳过存活检测直接扫端口（目标明确时）\n\n```bash\nfscan -h 192.168.1.0/24 -silent -np\n```\n\n### 指定端口精确扫描\n\n```bash\nfscan -h 10.0.0.0/24 -silent -p 22,80,443,445,3389,3306,6379\n```\n\n### 仅存活探测\n\n```bash\nfscan -h 172.16.0.0/16 -silent -m icmp\n```\n\n### 低速隐蔽扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent -t 30 -time 5\n```\n\n### 通过 SOCKS5 代理扫描内网\n\n```bash\nfscan -h 10.0.0.0/24 -silent -socks5 127.0.0.1:1080\n```\n\n### 仅做弱口令检测\n\n```bash\nfscan -h 192.168.1.10 -silent -m ssh -user root -pwdf /path/to/passwords.txt\n```\n\n### Web 目标扫描\n\n```bash\nfscan -u https://target.com -silent -full\n```\n\n### 多目标文件批量扫描\n\n```bash\nfscan -hf targets.txt -silent -o results.json -f json\n```\n\n### 带调试日志的排障扫描\n\n```bash\n# NDJSON 到 stdout，debug 日志到文件，互不干扰\nfscan -h 192.168.1.0/24 -silent -debug\n# 事后查看：cat fscan_debug.log\n```\n\n## AI Agent 结果处理\n\n### Python 管道消费\n\n```python\nimport json, subprocess\n\nproc = subprocess.Popen(\n    [\"fscan\", \"-h\", \"192.168.1.0/24\", \"-silent\"],\n    stdout=subprocess.PIPE, text=True\n)\n\nhosts, services, vulns = [], [], []\nfor line in proc.stdout:\n    r = json.loads(line)\n    if r[\"type\"] == \"HOST\":\n        hosts.append(r[\"host\"])\n    elif r[\"type\"] == \"SERVICE\":\n        services.append(r)\n    elif r[\"type\"] == \"VULN\":\n        vulns.append(r)\n\nproc.wait()\n```\n\n### jq 过滤\n\n```bash\n# 提取所有弱口令\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.username != null) | \"\\(.host):\\(.port) \\(.service) \\(.username):\\(.password)\"'\n\n# 提取所有漏洞\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"VULN\") | \"\\(.host):\\(.port) \\(.vulnerability)\"'\n\n# 提取 Web 服务\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.url != null) | \"\\(.url) \\(.title)\"'\n\n# 统计开放端口\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"PORT\") | .port' | sort -n | uniq -c | sort -rn\n```\n\n## 注意事项\n\n- `-silent` 抑制所有人类可读日志，stdout 仅输出 NDJSON\n- 空字段不出现在 JSON 中（`omitempty`）\n- 进程退出码 `0` 正常完成，非 `0` 表示参数错误或初始化失败\n- `-silent` 和 `-debug` 可同时使用，互不干扰\n- SOCKS5 代理下 fscan 信任协议层连接结果，不做额外深度验证\n- 扫描大网段时线程数会自动调整，资源耗尽时自适应降级\n- 默认超时 3 秒，防火墙 drop 的端口会静默超时，不计入失败率\n","plugins/local/auto.json":"{\n    \"ALYac\": {\n        \"processes\": [\n            \"aylaunch.exe\",\n            \"ayupdate2.exe\",\n            \"AYRTSrv.exe\",\n            \"AYAgent.exe\"\n        ],\n        \"url\": \"https://en.estsecurity.com/\"\n    },\n    \"AVG\": {\n        \"processes\": [\n            \"AVGSvc.exe\",\n            \"AVGUI.exe\",\n            \"avgwdsvc.exe\",\n            \"avg.exe\",\n            \"avgaurd.exe\",\n            \"avgemc.exe\",\n            \"avgrsx.exe\",\n            \"avgserv.exe\",\n            \"avgw.exe\"\n        ],\n        \"url\": \"https://www.avg.com/\"\n    },\n    \"Acronis\": {\n        \"processes\": [\n            \"arsm.exe\",\n            \"acronis_license_service.exe\"\n        ],\n        \"url\": \"https://www.acronis.com/\"\n    },\n    \"Ad-Aware\": {\n        \"processes\": [\n            \"AdAwareService.exe\",\n            \"Ad-Aware.exe\",\n            \"AdAware.exe\"\n        ],\n        \"url\": \"https://www.adaware.com/\"\n    },\n    \"AhnLab-V3\": {\n        \"processes\": [\n            \"patray.exe\",\n            \"V3Svc.exe\"\n        ],\n        \"url\": \"https://global.ahnlab.com/site/main.do\"\n    },\n    \"Arcabit\": {\n        \"processes\": [\n            \"arcavir.exe\",\n            \"arcadc.exe\",\n            \"ArcaVirMaster.exe\",\n            \"ArcaMainSV.exe\",\n            \"ArcaTasksService.exe\"\n        ],\n        \"url\": \"https://www.arcabit.pl\"\n    },\n    \"Avast\": {\n        \"processes\": [\n            \"ashDisp.exe\",\n            \"AvastUI.exe\",\n            \"AvastSvc.exe\",\n            \"AvastBrowser.exe\",\n            \"AfwServ.exe\"\n        ],\n        \"url\": \"https://www.avast.com\"\n    },\n    \"Avira AntiVirus(小红伞)\": {\n        \"processes\": [\n            \"avcenter.exe\",\n            \"avguard.exe\",\n            \"avgnt.exe\",\n            \"sched.exe\"\n        ],\n        \"url\": \"https://www.avira.com/\"\n    },\n    \"Baidu AntiVirus\": {\n        \"processes\": [\n            \"BaiduSdSvc.exe\",\n            \"BaiduSdTray.exe\",\n            \"BaiduSd.exe\",\n            \"bddownloader.exe\",\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"https://anquan.baidu.com/\"\n    },\n    \"BitDefender\": {\n        \"processes\": [\n            \"Bdagent.exe\",\n            \"BitDefenderCom.exe\",\n            \"vsserv.exe\",\n            \"bdredline.exe\",\n            \"secenter.exe\",\n            \"bdservicehost.exe\",\n            \"BITDEFENDER.exe\"\n        ],\n        \"url\": \"http://www.bitdefender.com/\"\n    },\n    \"Bkav\": {\n        \"processes\": [\n            \"BKavService.exe\",\n            \"Bka.exe\",\n            \"BkavUtil.exe\",\n            \"BLuPro.exe\"\n        ],\n        \"url\": \"https://www.bkav.com/\"\n    },\n    \"CAT-QuickHeal\": {\n        \"processes\": [\n            \"QUHLPSVC.exe\",\n            \"onlinent.exe\",\n            \"sapissvc.exe\",\n            \"scanwscs.exe\"\n        ],\n        \"url\": \"https://www.quickheal.com/\"\n    },\n    \"CMC\": {\n        \"processes\": [\n            \"CMCTrayIcon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/\"\n    },\n    \"ClamAV\": {\n        \"processes\": [\n            \"freshclam.exe\"\n        ],\n        \"url\": \"https://www.clamav.net\"\n    },\n    \"Comodo\": {\n        \"processes\": [\n            \"cpf.exe\",\n            \"cavwp.exe\",\n            \"ccavsrv.exe\",\n            \"cmdvirth.exe\"\n        ],\n        \"url\": \"https://www.comodo.com\"\n    },\n    \"CrowdStrike Falcon(猎鹰)\": {\n        \"processes\": [\n            \"csfalconservice.exe\",\n            \"CSFalconContainer.exe\"\n        ],\n        \"url\": \"https://www.crowdstrike.com\"\n    },\n    \"Cybereason\": {\n        \"processes\": [\n            \"CybereasonRansomFree.exe\",\n            \"CybereasonRansomFreeServiceHost.exe\",\n            \"CybereasonAV.exe\"\n        ],\n        \"url\": \"https://www.cybereason.com/\"\n    },\n    \"Cylance\": {\n        \"processes\": [\n            \"CylanceSvc.exe\"\n        ],\n        \"url\": \"https://www.cylance.com\"\n    },\n    \"Cyren\": {\n        \"processes\": [\n            \"vsedsps.exe\",\n            \"vseamps.exe\",\n            \"vseqrts.exe\"\n        ],\n        \"url\": \"http://www.cyren.com/\"\n    },\n    \"DrWeb\": {\n        \"processes\": [\n            \"drwebcom.exe\",\n            \"spidernt.exe\",\n            \"drwebscd.exe\",\n            \"drweb32w.exe\",\n            \"dwengine.exes\"\n        ],\n        \"url\": \"https://www.drweb.com/\"\n    },\n    \"Elastic Security\": {\n        \"processes\": [\n            \"elastic-endpoint.exe\",\n            \"elastic-agent.exe\",\n            \"agentbeat.exe\",\n            \"winlogbeat.exe\"\n        ],\n        \"url\": \"https://www.elastic.co/endpoint-detection-response\"\n    },\n    \"ESET-NOD32\": {\n        \"processes\": [\n            \"egui.exe\",\n            \"ecls.exe\",\n            \"ekrn.exe\",\n            \"eguiProxy.exe\",\n            \"EShaSrv.exe\"\n        ],\n        \"url\": \"https://www.eset.com/us/home/antivirus/\"\n    },\n    \"Trend Micro（趋势科技）\": {\n        \"processes\": [\n            \"tmpfw.exe\",\n            \"tmlisten.exe\",\n            \"coreServiceShell.exe\",\n            \"coreFrameworkHost.exe\",\n            \"uiWatchDog.exe\",\n            \"TMLISTEN.exe\"\n        ],\n        \"url\": \"https://www.trendmicro.com\"\n    },\n    \"Emsisoft\": {\n        \"processes\": [\n            \"a2guard.exe\",\n            \"a2free.exe\",\n            \"a2service.exe\"\n        ],\n        \"url\": \"https://www.emsisoft.com/\"\n    },\n    \"Endgame\": {\n        \"processes\": [\n            \"endgame.exe\"\n        ],\n        \"url\": \"https://www.endgame.com/\"\n    },\n    \"F-Prot\": {\n        \"processes\": [\n            \"F-PROT.exe\",\n            \"FProtTray.exe\",\n            \"FPAVServer.exe\",\n            \"f-stopw.exe\",\n            \"f-prot95.exe\",\n            \"f-agnt95.exe\"\n        ],\n        \"url\": \"http://f-prot.com/\"\n    },\n    \"F-Secure\": {\n        \"processes\": [\n            \"f-secure.exe\",\n            \"fssm32.exe\",\n            \"Fsorsp64.exe\",\n            \"fsavgui.exe\",\n            \"fameh32.exe\",\n            \"fch32.exe\",\n            \"fih32.exe\",\n            \"fnrb32.exe\",\n            \"fsav32.exe\",\n            \"fsma32.exe\",\n            \"fsmb32.exe\"\n        ],\n        \"url\": \"https://www.f-secure.com\"\n    },\n    \"FireEye(火眼)\": {\n        \"processes\": [\n            \"xagtnotif.exe\",\n            \"xagt.exe\"\n        ],\n        \"url\": \"https://www.fireeye.com\"\n    },\n    \"Trellix EDR(McAfee && 火眼)\": {\n        \"processes\": [\n            \"macmnsvc.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcshield.exe\",\n            \"mctray.exe\",\n            \"mfeatp.exe\",\n            \"mfeensppl.exe\",\n            \"mfeesp.exe\",\n            \"mfefw.exe\",\n            \"mfehcs.exe\",\n            \"mfemactl.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfevtps.exe\",\n            \"mfewch.exe\",\n            \"updaterui.exe\"\n        ],\n        \"url\": \"https://www.trellix.com\"\n    },\n    \"Fortinet（飞塔）\": {\n        \"processes\": [\n            \"FortiClient.exe\",\n            \"FortiTray.exe\",\n            \"FortiScand.exe\",\n            \"FortiWF.exe\",\n            \"FortiProxy.exe\",\n            \"FortiESNAC.exe\",\n            \"FortiSSLVPNdaemon.exe\",\n            \"FortiTcs.exe\",\n            \"FctSecSvr.exe\"\n        ],\n        \"url\": \"https://fortiguard.com/\"\n    },\n    \"GData\": {\n        \"processes\": [\n            \"AVK.exe\",\n            \"avkcl.exe\",\n            \"avkpop.exe\",\n            \"avkservice.exe\",\n            \"GDScan.exe\",\n            \"AVKWCtl.exe\",\n            \"AVKProxy.exe\",\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"https://www.gdatasoftware.com/\"\n    },\n    \"Ikarus\": {\n        \"processes\": [\n            \"guardxservice.exe\",\n            \"guardxkickoff.exe\"\n        ],\n        \"url\": \"https://www.ikarussecurity.com/\"\n    },\n    \"Jiangmin\": {\n        \"processes\": [\n            \"KVFW.exe\",\n            \"KVsrvXP.exe\",\n            \"KVMonXP.exe\",\n            \"KVwsc.exe\"\n        ],\n        \"url\": \"https://www.jiangmin.com/\"\n    },\n    \"K7AntiVirus\": {\n        \"processes\": [\n            \"K7TSecurity.exe\",\n            \"K7TSMain.Exe\",\n            \"K7TSUpdT.exe\"\n        ],\n        \"url\": \"http://viruslab.k7computing.com/\"\n    },\n    \"Kaspersky(卡巴斯基)\": {\n        \"processes\": [\n            \"avp.exe\",\n            \"avpcc.exe\",\n            \"avpm.exe\",\n            \"kavpf.exe\",\n            \"kavfs.exe\",\n            \"klnagent.exe\",\n            \"kavtray.exe\",\n            \"kavfswp.exe\",\n            \"kaspersky.exe\"\n        ],\n        \"url\": \"https://www.kaspersky.com\"\n    },\n    \"Max Secure Software\": {\n        \"processes\": [\n            \"SDSystemTray.exe\",\n            \"MaxRCSystemTray.exe\",\n            \"RCSystemTray.exe\",\n            \"MaxAVPlusDM.exe\",\n            \"LiveUpdateSD.exe\"\n        ],\n        \"url\": \"https://www.maxpcsecure.com/\"\n    },\n    \"Malwarebytes\": {\n        \"processes\": [\n            \"MBAMService.exe\",\n            \"mbam.exe\",\n            \"mbamtray.exe\"\n        ],\n        \"url\": \"https://www.malwarebytes.com/\"\n    },\n    \"McAfee(迈克菲-可能为Trellix)\": {\n        \"processes\": [\n            \"Mcshield.exe\",\n            \"Tbmon.exe\",\n            \"Frameworkservice.exe\",\n            \"firesvc.exe\",\n            \"firetray.exe\",\n            \"hipsvc.exe\",\n            \"mfevtps.exe\",\n            \"mcafeefire.exe\",\n            \"shstat.exe\",\n            \"vstskmgr.exe\",\n            \"engineserver.exe\",\n            \"alogserv.exe\",\n            \"avconsol.exe\",\n            \"cmgrdian.exe\",\n            \"cpd.exe\",\n            \"mcmnhdlr.exe\",\n            \"mcvsshld.exe\",\n            \"mcvsrte.exe\",\n            \"mghtml.exe\",\n            \"mpfservice.exe\",\n            \"mpfagent.exe\",\n            \"mpftray.exe\",\n            \"vshwin32.exe\",\n            \"vsstat.exe\",\n            \"guarddog.exe\",\n            \"mfeann.exe\",\n            \"udaterui.exe\",\n            \"naprdmgr.exe\",\n            \"mctray.exe\",\n            \"fcagate.exe\",\n            \"fcag.exe\",\n            \"fcags.exe\",\n            \"fcagswd.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcamnsvc.exe\",\n            \"mctary.exe\",\n            \"mfecanary.exe\",\n            \"mfeconsole.exe\",\n            \"mfeesp.exe\",\n            \"mfefire.exe\",\n            \"mfefw.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfewc.exe\",\n            \"mfewch.exe\"\n        ],\n        \"url\": \"https://www.mcafee.com/en-us\"\n    },\n    \"Microsoft Defender(Windows Defender)\": {\n        \"processes\": [\n            \"MsMpEng.exe\",\n            \"msseces.exe\",\n            \"mssecess.exe\",\n            \"emet_agent.exe\",\n            \"emet_service.exe\",\n            \"drwatson.exe\",\n            \"MpCmdRun.exe\",\n            \"NisSrv.exe\",\n            \"MsSense.exe\",\n            \"MSASCui.exe\",\n            \"MSASCuiL.exe\",\n            \"SecurityHealthService.exe\"\n        ],\n        \"url\": \"https://www.microsoft.com/en-us/windows/comprehensive-security\"\n    },\n    \"NANO-Antivirus\": {\n        \"processes\": [\n            \"nanoav.exe\",\n            \"nanoav64.exe\",\n            \"nanoreport.exe\",\n            \"nanoreportc.exe\",\n            \"nanoreportc64.exe\",\n            \"nanorst.exe\",\n            \"nanosvc.exe\"\n        ],\n        \"url\": \"https://nano-av.com/\"\n    },\n    \"Palo Alto Networks\": {\n        \"processes\": [\n            \"PanInstaller.exe\"\n        ],\n        \"url\": \"https://www.paloaltonetworks.com/\"\n    },\n    \"Panda Security\": {\n        \"processes\": [\n            \"remupd.exe\",\n            \"apvxdwin.exe\",\n            \"pavproxy.exe\",\n            \"pavsched.exe\"\n        ],\n        \"url\": \"https://www.pandasecurity.com/\"\n    },\n    \"Qihoo-360\": {\n        \"processes\": [\n            \"360sd.exe\",\n            \"360tray.exe\",\n            \"ZhuDongFangYu.exe\",\n            \"360rp.exe\",\n            \"360rps.exe\",\n            \"360safe.exe\",\n            \"360safebox.exe\",\n            \"QHActiveDefense.exe\",\n            \"360skylarsvc.exe\",\n            \"LiveUpdate360.exe\"\n        ],\n        \"url\": \"https://sd.360.cn/\"\n    },\n    \"Rising\": {\n        \"processes\": [\n            \"RavMonD.exe\",\n            \"rfwmain.exe\",\n            \"RsMgrSvc.exe\",\n            \"RavMon.exe\"\n        ],\n        \"url\": \"http://antivirus.rising.com.cn/\"\n    },\n    \"SUPERAntiSpyware\": {\n        \"processes\": [\n            \"superantispyware.exe\",\n            \"sascore.exe\",\n            \"SAdBlock.exe\",\n            \"sabsvc.exe\"\n        ],\n        \"url\": \"http://www.superadblocker.com/\"\n    },\n    \"SecureAge APEX\": {\n        \"processes\": [\n            \"UniversalAVService.exe\",\n            \"EverythingServer.exe\",\n            \"clamd.exe\"\n        ],\n        \"url\": \"https://www.secureage.com/\"\n    },\n    \"Sophos AV\": {\n        \"processes\": [\n            \"SavProgress.exe\",\n            \"icmon.exe\",\n            \"SavMain.exe\",\n            \"SophosUI.exe\",\n            \"SophosFS.exe\",\n            \"SophosHealth.exe\",\n            \"SophosSafestore64.exe\",\n            \"SophosCleanM.exe\",\n            \"SophosFileScanner.exe\",\n            \"SophosNtpService.exe\",\n            \"SophosOsquery.exe\",\n            \"Sophos UI.exe\"\n        ],\n        \"url\": \"https://www.sophos.com/\"\n    },\n    \"TACHYON\": {\n        \"processes\": [],\n        \"url\": \"https://www.tachyonlab.com/en/index.html\"\n    },\n    \"Tencent\": {\n        \"processes\": [\n            \"QQPCRTP.exe\",\n            \"QQPCTray.exe\",\n            \"QQPCMgr.exe\",\n            \"QQPCNetFlow.exe\",\n            \"QQPCRealTimeSpeedup.exe\"\n        ],\n        \"url\": \"https://guanjia.qq.com\"\n    },\n    \"TotalDefense\": {\n        \"processes\": [\n            \"AMRT.exe\",\n            \"SWatcherSrv.exe\",\n            \"Prd.ManagementConsole.exe\"\n        ],\n        \"url\": \"https://www.totaldefense.com\"\n    },\n    \"Trapmine\": {\n        \"processes\": [\n            \"TrapmineEnterpriseService.exe\",\n            \"TrapmineEnterpriseConfig.exe\",\n            \"TrapmineDeployer.exe\",\n            \"TrapmineUpgradeService.exe\"\n        ],\n        \"url\": \"https://trapmine.com/\"\n    },\n    \"TrendMicro\": {\n        \"processes\": [\n            \"TMBMSRV.exe\",\n            \"ntrtscan.exe\",\n            \"Pop3Trap.exe\",\n            \"WebTrap.exe\",\n            \"PccNTMon.exe\"\n        ],\n        \"url\": \"http://careers.trendmicro.com.cn/\"\n    },\n    \"VIPRE\": {\n        \"processes\": [\n            \"SBAMSvc.exe\",\n            \"VipreEdgeProtection.exe\",\n            \"SBAMTray.exe\"\n        ],\n        \"url\": \"https://www.vipre.com\"\n    },\n    \"ViRobot\": {\n        \"processes\": [\n            \"vrmonnt.exe\",\n            \"vrmonsvc.exe\",\n            \"Vrproxyd.exe\"\n        ],\n        \"url\": \"http://www.hauri.net/\"\n    },\n    \"Webroot\": {\n        \"processes\": [\n            \"npwebroot.exe\",\n            \"WRSA.exe\",\n            \"spysweeperui.exe\"\n        ],\n        \"url\": \"https://www.webroot.com/us/en\"\n    },\n    \"Yandex\": {\n        \"processes\": [\n            \"Yandex.exe\",\n            \"YandexDisk.exe\",\n            \"yandesk.exe\"\n        ],\n        \"url\": \"https://yandex.com/support/common/security/antiviruses-free.html\"\n    },\n    \"Zillya\": {\n        \"processes\": [\n            \"zillya.exe\",\n            \"ZAVAux.exe\",\n            \"ZAVCore.exe\"\n        ],\n        \"url\": \"https://zillya.com\"\n    },\n    \"ZoneAlarm\": {\n        \"processes\": [\n            \"vsmon.exe\",\n            \"zapro.exe\",\n            \"zonealarm.exe\"\n        ],\n        \"url\": \"https://www.zonealarm.com/\"\n    },\n    \"Zoner\": {\n        \"processes\": [\n            \"ZPSTray.exe\"\n        ],\n        \"url\": \"https://zonerantivirus.com/\"\n    },\n    \"eGambit\": {\n        \"processes\": [\n            \"dasc.exe\",\n            \"memscan64.exe\",\n            \"dastray.exe\"\n        ],\n        \"url\": \"https://egambit.app/en/\"\n    },\n    \"eScan\": {\n        \"processes\": [\n            \"consctl.exe\",\n            \"mwaser.exe\",\n            \"avpmapp.exe\"\n        ],\n        \"url\": \"https://www.escanav.com/\"\n    },\n    \"Lavasoft\": {\n        \"processes\": [\n            \"AAWTray.exe\",\n            \"LavasoftTcpService.exe\",\n            \"AdAwareTray.exe\",\n            \"WebCompanion.exe\",\n            \"WebCompanionInstaller.exe\",\n            \"adawarebp.exe\",\n            \"ad-watch.exe\"\n        ],\n        \"url\": \"https://www.lavasoft.com/\"\n    },\n    \"The Cleaner\": {\n        \"processes\": [\n            \"cleaner8.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"VBA32\": {\n        \"processes\": [\n            \"vba32lder.exe\"\n        ],\n        \"url\": \"http://www.anti-virus.by/en/index.shtml\"\n    },\n    \"Mongoosa\": {\n        \"processes\": [\n            \"MongoosaGUI.exe\",\n            \"mongoose.exe\"\n        ],\n        \"url\": \"https://www.securitymongoose.com/\"\n    },\n    \"Coranti2012\": {\n        \"processes\": [\n            \"CorantiControlCenter32.exe\"\n        ],\n        \"url\": \"https://www.coranti.com\"\n    },\n    \"UnThreat\": {\n        \"processes\": [\n            \"UnThreat.exe\",\n            \"utsvc.exe\"\n        ],\n        \"url\": \"https://softplanet.com/UnThreat-AntiVirus\"\n    },\n    \"Shield Antivirus\": {\n        \"processes\": [\n            \"CKSoftShiedAntivirus4.exe\",\n            \"shieldtray.exe\"\n        ],\n        \"url\": \"https://shieldapps.com/supportmain/shield-antivirus-support/\"\n    },\n    \"VIRUSfighter\": {\n        \"processes\": [\n            \"AVWatchService.exe\",\n            \"vfproTray.exe\"\n        ],\n        \"url\": \"https://www.spamfighter.com/VIRUSfighter/\"\n    },\n    \"Immunet\": {\n        \"processes\": [\n            \"iptray.exe\"\n        ],\n        \"url\": \"https://www.immunet.com/index\"\n    },\n    \"PSafe\": {\n        \"processes\": [\n            \"PSafeSysTray.exe\",\n            \"PSafeCategoryFinder.exe\",\n            \"psafesvc.exe\"\n        ],\n        \"url\": \"https://www.psafe.com/\"\n    },\n    \"nProtect\": {\n        \"processes\": [\n            \"nspupsvc.exe\",\n            \"Npkcmsvc.exe\",\n            \"npnj5Agent.exe\"\n        ],\n        \"url\": \"http://nos.nprotect.com/\"\n    },\n    \"Spyware Terminator\": {\n        \"processes\": [\n            \"SpywareTerminatorShield.exe\",\n            \"SpywareTerminator.exe\"\n        ],\n        \"url\": \"http://www.spywareterminator.com/Default.aspx\"\n    },\n    \"Norton（赛门铁克）\": {\n        \"processes\": [\n            \"ccSvcHst.exe\",\n            \"rtvscan.exe\",\n            \"ccapp.exe\",\n            \"NPFMntor.exe\",\n            \"ccRegVfy.exe\",\n            \"vptray.exe\",\n            \"iamapp.exe\",\n            \"nav.exe\",\n            \"navapw32.exe\",\n            \"navapsvc.exe\",\n            \"nisum.exe\",\n            \"nmain.exe\",\n            \"nprotect.exe\",\n            \"smcGui.exe\",\n            \"ns.exe\",\n            \"nortonsecurity.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n        \"Norton V25（Avast）\": {\n        \"processes\": [\n            \"afwServ.exe\",\n            \"aswEngSrv.exe\",\n            \"aswidsagent.exe\",\n            \"AvDump.exe\",\n            \"nllToolsSvc.exe\",\n            \"NortonSvc.exe\",\n            \"wsc_proxy.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n    \"Symantec（赛门铁克）\": {\n        \"processes\": [\n            \"ccSetMgr.exe\",\n            \"ccapp.exe\",\n            \"vptray.exe\",\n            \"ccpxysvc.exe\",\n            \"cfgwiz.exe\",\n            \"smc.exe\",\n            \"symproxysvc.exe\",\n            \"vpc32.exe\",\n            \"lsetup.exe\",\n            \"luall.exe\",\n            \"lucomserver.exe\",\n            \"sbserv.exe\",\n            \"ccEvtMgr.exe\",\n            \"smcGui.exe\",\n            \"snac.exe\",\n            \"SymCorpUI.exe\",\n            \"sepWscSvc64.exe\"\n        ],\n        \"url\": \"http://www.symantec.com/\"\n    },\n    \"可牛杀毒\": {\n        \"processes\": [\n            \"knsdtray.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E5%8F%AF%E7%89%9B%E5%85%8D%E8%B4%B9%E6%9D%80%E6%AF%92%E8%BD%AF%E4%BB%B6\"\n    },\n    \"流量矿石\": {\n        \"processes\": [\n            \"Miner.exe\"\n        ],\n        \"url\": \"https://jiaoyi.yunfan.com/\"\n    },\n    \"SafeDog(安全狗)\": {\n        \"processes\": [\n            \"safedog.exe\",\n            \"SafeDogGuardCenter.exe\",\n            \"SafeDogSiteIIS.exe\",\n            \"SafeDogTray.exe\",\n            \"SafeDogServerUI.exe\",\n            \"SafeDogSiteApache.exe\",\n            \"CloudHelper.exe\",\n            \"SafeDogUpdateCenter.exe\"\n        ],\n        \"url\": \"http://www.safedog.cn/\"\n    },\n    \"木马克星\": {\n        \"processes\": [\n            \"parmor.exe\",\n            \"Iparmor.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E6%9C%A8%E9%A9%AC%E5%85%8B%E6%98%9F/2979824?fr=aladdin\"\n    },\n    \"贝壳云安全\": {\n        \"processes\": [\n            \"beikesan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"木马猎手\": {\n        \"processes\": [\n            \"TrojanHunter.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"巨盾网游安全盾\": {\n        \"processes\": [\n            \"GG.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"绿鹰安全精灵\": {\n        \"processes\": [\n            \"adam.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E7%BB%BF%E9%B9%B0%E5%AE%89%E5%85%A8%E7%B2%BE%E7%81%B5\"\n    },\n    \"超级巡警\": {\n        \"processes\": [\n            \"AST.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"墨者安全专家\": {\n        \"processes\": [\n            \"ananwidget.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"风云防火墙\": {\n        \"processes\": [\n            \"FYFireWall.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"微点主动防御\": {\n        \"processes\": [\n            \"MPMon.exe\"\n        ],\n        \"url\": \"http://www.micropoint.com.cn/\"\n    },\n    \"天网防火墙\": {\n        \"processes\": [\n            \"pfw.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"D 盾\": {\n        \"processes\": [\n            \"D_Safe_Manage.exe\",\n            \"d_manage.exe\"\n        ],\n        \"url\": \"http://www.d99net.net/\"\n    },\n    \"云锁\": {\n        \"processes\": [\n            \"yunsuo_agent_service.exe\",\n            \"yunsuo_agent_daemon.exe\"\n        ],\n        \"url\": \"https://www.yunsuo.com.cn/\"\n    },\n    \"护卫神\": {\n        \"processes\": [\n            \"HwsPanel.exe\",\n            \"hws_ui.exe\",\n            \"hws.exe\",\n            \"hwsd.exe\",\n            \"HwsHostPanel.exe\",\n            \"HwsHostMaster.exe\"\n        ],\n        \"url\": \"https://www.hws.com/\"\n    },\n    \"火绒安全\": {\n        \"processes\": [\n            \"hipstray.exe\",\n            \"wsctrl.exe\",\n            \"usysdiag.exe\",\n            \"HipsDaemon.exe\",\n            \"HipsLog.exe\",\n            \"HipsMain.exe\",\n            \"wsctrlsvc.exe\"\n        ],\n        \"url\": \"https://www.huorong.cn/\"\n    },\n    \"网络病毒克星\": {\n        \"processes\": [\n            \"WEBSCANX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"SPHINX防火墙\": {\n        \"processes\": [\n            \"SPHINX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"奇安信天擎\": {\n        \"processes\": [\n            \"TQClient.exe\",\n            \"TQTray.exe\",\n            \"QaxEngManager.exe\",\n            \"TQDefender.exe\"\n        ],\n        \"url\": \"https://www.qianxin.com/product/detail/pid/330\"\n    },\n    \"H+BEDV Datentechnik GmbH\": {\n        \"processes\": [\n            \"avwin.exe\",\n            \"avwupsrv.exe\"\n        ],\n        \"url\": \"http://www.free-av.com/\"\n    },\n    \"IBM ISS Proventia\": {\n        \"processes\": [\n            \"blackd.exe\",\n            \"rapapp.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"eEye Digital Security\": {\n        \"processes\": [\n            \"eeyeevnt.exe\",\n            \"blink.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"TamoSoft\": {\n        \"processes\": [\n            \"cv.exe\",\n            \"ent.exe\"\n        ],\n        \"url\": \"https://www.tamos.com/\"\n    },\n    \"Kerio Personal Firewall\": {\n        \"processes\": [\n            \"persfw.exe\",\n            \"wrctrl.exe\"\n        ],\n        \"url\": \"http://www.kerio.com/\"\n    },\n    \"Simplysup\": {\n        \"processes\": [\n            \"Trjscan.exe\"\n        ],\n        \"url\": \"https://www.simplysup.com/\"\n    },\n    \"PC Tools AntiVirus\": {\n        \"processes\": [\n            \"PCTAV.exe\",\n            \"pctsGui.exe\"\n        ],\n        \"url\": \"http://www.pctools.com\"\n    },\n    \"VirusBuster Professional\": {\n        \"processes\": [\n            \"vbcmserv.exe\"\n        ],\n        \"url\": \"http://www.virusbuster.hu\"\n    },\n    \"ClamWin\": {\n        \"processes\": [\n            \"ClamTray.exe\",\n            \"clamscan.exe\"\n        ],\n        \"url\": \"http://www.clamwin.com/\"\n    },\n    \"安天智甲\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kscan.exe\",\n            \"AMediumManager.exe\",\n            \"kismain.exe\"\n        ],\n        \"url\": \"https://antiy.cn/\"\n    },\n    \"CMC Endpoint Security\": {\n        \"processes\": [\n            \"CMCNECore.exe\",\n            \"cmcepagent.exe\",\n            \"cmccore.exe\",\n            \"CMCLog.exe\",\n            \"CMCFMon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/giai-phap/\"\n    },\n    \"金山毒霸\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kxescore.exe\",\n            \"kupdata.exe\",\n            \"kwsprotect64.exe\",\n            \"kislive.exe\",\n            \"knewvip.exe\",\n            \"kscan.exe\",\n            \"kxecenter.exe\",\n            \"kxemain.exe\",\n            \"KWatch.exe\",\n            \"KSafeSvc.exe\",\n            \"KSafeTray.exe\"\n        ],\n        \"url\": \"http://www.ijinshan.com/\"\n    },\n    \"Agnitum outpost (Outpost Firewall)\": {\n        \"processes\": [\n            \"outpost.exe\",\n            \"acs.exe\"\n        ],\n        \"url\": \"https://agnitum-outpost-security-suite.en.softonic.com/\"\n    },\n    \"Cynet\": {\n        \"processes\": [\n            \"CynetLauncher.exe\",\n            \"CynetDS.exe\",\n            \"CynetEPS.exe\",\n            \"CynetMS.exe\",\n            \"CynetAR.exe\",\n            \"CynetGW.exe\",\n            \"CynetSD64.exe\"\n        ],\n        \"url\": \"https://www.cynet.com/\"\n    },\n    \"金山网盾\": {\n        \"processes\": [\n            \"KSWebShield.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data安全软件客户端\": {\n        \"processes\": [\n            \"AVK.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"金山网镖\": {\n        \"processes\": [\n            \"kpfwtray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在扫1433\": {\n        \"processes\": [\n            \"1433.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在爆破\": {\n        \"processes\": [\n            \"DUB.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"发现S-U\": {\n        \"processes\": [\n            \"ServUDaemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士\": {\n        \"processes\": [\n            \"bddownloader.exe\",\n            \"baiduSafeTray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士-主进程\": {\n        \"processes\": [\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"已知杀软进程,名称暂未收录\": {\n        \"processes\": [\n            \"scan32.exe\",\n            \"mcscript.exe\",\n            \"cleanup.exe\",\n            \"cmdagent.exe\",\n            \"frminst.exe\",\n            \"mcscript_inuse.exe\",\n            \"_avp32.exe\",\n            \"_avpcc.exe\",\n            \"_avpm.exe\",\n            \"aAvgApi.exe\",\n            \"ackwin32.exe\",\n            \"advxdwin.exe\",\n            \"agentsvr.exe\",\n            \"agentw.exe\",\n            \"alertsvc.exe\",\n            \"alevir.exe\",\n            \"amon9x.exe\",\n            \"anti-trojan.exe\",\n            \"antivirus.exe\",\n            \"ants.exe\",\n            \"apimonitor.exe\",\n            \"aplica32.exe\",\n            \"arr.exe\",\n            \"atcon.exe\",\n            \"atguard.exe\",\n            \"atro55en.exe\",\n            \"atupdater.exe\",\n            \"atwatch.exe\",\n            \"au.exe\",\n            \"aupdate.exe\",\n            \"auto-protect.nav80try.exe\",\n            \"autodown.exe\",\n            \"autotrace.exe\",\n            \"autoupdate.exe\",\n            \"ave32.exe\",\n            \"avgcc32.exe\",\n            \"avgctrl.exe\",\n            \"avgserv9.exe\",\n            \"avkpop.exe\",\n            \"avkserv.exe\",\n            \"avkservice.exe\",\n            \"avltmain.exe\",\n            \"avnt.exe\",\n            \"avp32.exe\",\n            \"avpdos32.exe\",\n            \"avptc32.exe\",\n            \"avpupd.exe\",\n            \"avsched32.exe\",\n            \"avsynmgr.exe\",\n            \"avwin95.exe\",\n            \"avwinnt.exe\",\n            \"avwupd.exe\",\n            \"avwupd32.exe\",\n            \"avxmonitor9x.exe\",\n            \"avxmonitornt.exe\",\n            \"avxquar.exe\",\n            \"backweb.exe\",\n            \"bargains.exe\",\n            \"bd_professional.exe\",\n            \"beagle.exe\",\n            \"belt.exe\",\n            \"bidef.exe\",\n            \"bidserver.exe\",\n            \"bipcp.exe\",\n            \"bipcpevalsetup.exe\",\n            \"bisp.exe\",\n            \"blackice.exe\",\n            \"blss.exe\",\n            \"bootconf.exe\",\n            \"bootwarn.exe\",\n            \"borg2.exe\",\n            \"bpc.exe\",\n            \"brasil.exe\",\n            \"bs120.exe\",\n            \"bundle.exe\",\n            \"bvt.exe\",\n            \"cdp.exe\",\n            \"cfd.exe\",\n            \"cfiadmin.exe\",\n            \"cfiaudit.exe\",\n            \"cfinet.exe\",\n            \"cfinet32.exe\",\n            \"claw95.exe\",\n            \"claw95cf.exe\",\n            \"clean.exe\",\n            \"cleaner.exe\",\n            \"cleaner3.exe\",\n            \"cleanpc.exe\",\n            \"click.exe\",\n            \"cmesys.exe\",\n            \"cmon016.exe\",\n            \"connectionmonitor.exe\",\n            \"cpf9x206.exe\",\n            \"cpfnt206.exe\",\n            \"ctrl.exe\",\n            \"cwnb181.exe\",\n            \"cwntdwmo.exe\",\n            \"datemanager.exe\",\n            \"dcomx.exe\",\n            \"defalert.exe\",\n            \"defscangui.exe\",\n            \"defwatch.exe\",\n            \"deputy.exe\",\n            \"divx.exe\",\n            \"dllcache.exe\",\n            \"dllreg.exe\",\n            \"doors.exe\",\n            \"dpf.exe\",\n            \"dpfsetup.exe\",\n            \"dpps2.exe\",\n            \"drweb32.exe\",\n            \"drwebupw.exe\",\n            \"dssagent.exe\",\n            \"dvp95.exe\",\n            \"dvp95_0.exe\",\n            \"ecengine.exe\",\n            \"efpeadm.exe\",\n            \"emsw.exe\",\n            \"ent.exe\",\n            \"esafe.exe\",\n            \"escanhnt.exe\",\n            \"escanv95.exe\",\n            \"espwatch.exe\",\n            \"ethereal.exe\",\n            \"etrustcipe.exe\",\n            \"evpn.exe\",\n            \"exantivirus-cnet.exe\",\n            \"exe.avxw.exe\",\n            \"expert.exe\",\n            \"explore.exe\",\n            \"fast.exe\",\n            \"findviru.exe\",\n            \"firewall.exe\",\n            \"fp-win.exe\",\n            \"fp-win_trial.exe\",\n            \"fprot.exe\",\n            \"frw.exe\",\n            \"fsaa.exe\",\n            \"fsav.exe\",\n            \"fsav530stbyb.exe\",\n            \"fsav530wtbyb.exe\",\n            \"fsav95.exe\",\n            \"fsgk32.exe\",\n            \"fsm32.exe\",\n            \"gator.exe\",\n            \"gbmenu.exe\",\n            \"gbpoll.exe\",\n            \"generics.exe\",\n            \"gmt.exe\",\n            \"guard.exe\",\n            \"hacktracersetup.exe\",\n            \"hbinst.exe\",\n            \"hbsrv.exe\",\n            \"hotactio.exe\",\n            \"hotpatch.exe\",\n            \"htlog.exe\",\n            \"htpatch.exe\",\n            \"hwpe.exe\",\n            \"hxdl.exe\",\n            \"hxiul.exe\",\n            \"iamserv.exe\",\n            \"iamstats.exe\",\n            \"ibmasn.exe\",\n            \"ibmavsp.exe\",\n            \"icload95.exe\",\n            \"icloadnt.exe\",\n            \"icmon.exe\",\n            \"icsupp95.exe\",\n            \"icsuppnt.exe\",\n            \"idle.exe\",\n            \"iedll.exe\",\n            \"iedriver.exe\",\n            \"iface.exe\",\n            \"ifw2000.exe\",\n            \"inetlnfo.exe\",\n            \"infus.exe\",\n            \"infwin.exe\",\n            \"init.exe\",\n            \"intdel.exe\",\n            \"intren.exe\",\n            \"iomon98.exe\",\n            \"istsvc.exe\",\n            \"jammer.exe\",\n            \"jdbgmrg.exe\",\n            \"jedi.exe\",\n            \"kavlite40eng.exe\",\n            \"kavpers40eng.exe\",\n            \"kazza.exe\",\n            \"keenvalue.exe\",\n            \"kerio-pf-213-en-win.exe\",\n            \"kerio-wrl-421-en-win.exe\",\n            \"kerio-wrp-421-en-win.exe\",\n            \"kernel32.exe\",\n            \"killprocesssetup161.exe\",\n            \"launcher.exe\",\n            \"ldnetmon.exe\",\n            \"ldpro.exe\",\n            \"ldpromenu.exe\",\n            \"ldscan.exe\",\n            \"lnetinfo.exe\",\n            \"loader.exe\",\n            \"localnet.exe\",\n            \"lockdown.exe\",\n            \"lockdown2000.exe\",\n            \"lookout.exe\",\n            \"lordpe.exe\",\n            \"luau.exe\",\n            \"luinit.exe\",\n            \"luspt.exe\",\n            \"mapisvc32.exe\",\n            \"mcagent.exe\",\n            \"mctool.exe\",\n            \"mcupdate.exe\",\n            \"mfin32.exe\",\n            \"mfw2en.exe\",\n            \"mfweng3.02d30.exe\",\n            \"mgavrtcl.exe\",\n            \"mgavrte.exe\",\n            \"mgui.exe\",\n            \"minilog.exe\",\n            \"mmod.exe\",\n            \"monitor.exe\",\n            \"moolive.exe\",\n            \"mostat.exe\",\n            \"mrflux.exe\",\n            \"msapp.exe\",\n            \"msbb.exe\",\n            \"msblast.exe\",\n            \"mscache.exe\",\n            \"msccn32.exe\",\n            \"mscman.exe\",\n            \"msconfig.exe\",\n            \"msdm.exe\",\n            \"msdos.exe\",\n            \"msiexec16.exe\",\n            \"msinfo32.exe\",\n            \"mslaugh.exe\",\n            \"msmgt.exe\",\n            \"msmsgri32.exe\",\n            \"mssmmc32.exe\",\n            \"mssys.exe\",\n            \"msvxd.exe\",\n            \"mu0311ad.exe\",\n            \"mwatch.exe\",\n            \"n32scanw.exe\",\n            \"navap.navapsvc.exe\",\n            \"navdx.exe\",\n            \"navlu32.exe\",\n            \"navnt.exe\",\n            \"navstub.exe\",\n            \"navw32.exe\",\n            \"navwnt.exe\",\n            \"nc2000.exe\",\n            \"ncinst4.exe\",\n            \"ndd32.exe\",\n            \"neomonitor.exe\",\n            \"neowatchlog.exe\",\n            \"netarmor.exe\",\n            \"netd32.exe\",\n            \"netinfo.exe\",\n            \"netmon.exe\",\n            \"netscanpro.exe\",\n            \"netspyhunter-1.2.exe\",\n            \"netstat.exe\",\n            \"netutils.exe\",\n            \"nisserv.exe\",\n            \"nod32.exe\",\n            \"normist.exe\",\n            \"norton_internet_secu_3.0_407.exe\",\n            \"notstart.exe\",\n            \"npf40_tw_98_nt_me_2k.exe\",\n            \"npfmessenger.exe\",\n            \"npscheck.exe\",\n            \"npssvc.exe\",\n            \"nsched32.exe\",\n            \"nssys32.exe\",\n            \"nstask32.exe\",\n            \"nsupdate.exe\",\n            \"nt.exe\",\n            \"ntvdm.exe\",\n            \"ntxconfig.exe\",\n            \"nui.exe\",\n            \"nupgrade.exe\",\n            \"nvarch16.exe\",\n            \"nvc95.exe\",\n            \"nvsvc32.exe\",\n            \"nwinst4.exe\",\n            \"nwservice.exe\",\n            \"nwtool16.exe\",\n            \"ollydbg.exe\",\n            \"onsrvr.exe\",\n            \"optimize.exe\",\n            \"ostronet.exe\",\n            \"otfix.exe\",\n            \"outpostinstall.exe\",\n            \"outpostproinstall.exe\",\n            \"padmin.exe\",\n            \"panixk.exe\",\n            \"patch.exe\",\n            \"pavcl.exe\",\n            \"pavw.exe\",\n            \"pccwin98.exe\",\n            \"pcfwallicon.exe\",\n            \"pcip10117_0.exe\",\n            \"pcscan.exe\",\n            \"pdsetup.exe\",\n            \"periscope.exe\",\n            \"perswf.exe\",\n            \"pf2.exe\",\n            \"pfwadmin.exe\",\n            \"pgmonitr.exe\",\n            \"pingscan.exe\",\n            \"platin.exe\",\n            \"poproxy.exe\",\n            \"popscan.exe\",\n            \"portdetective.exe\",\n            \"portmonitor.exe\",\n            \"powerscan.exe\",\n            \"ppinupdt.exe\",\n            \"pptbc.exe\",\n            \"ppvstop.exe\",\n            \"prizesurfer.exe\",\n            \"prmt.exe\",\n            \"prmvr.exe\",\n            \"procdump.exe\",\n            \"processmonitor.exe\",\n            \"procexplorerv1.0.exe\",\n            \"programauditor.exe\",\n            \"proport.exe\",\n            \"protectx.exe\",\n            \"pspf.exe\",\n            \"purge.exe\",\n            \"qconsole.exe\",\n            \"qserver.exe\",\n            \"rav7.exe\",\n            \"rav7win.exe\",\n            \"rav8win32eng.exe\",\n            \"ray.exe\",\n            \"rb32.exe\",\n            \"rcsync.exe\",\n            \"realmon.exe\",\n            \"reged.exe\",\n            \"regedit.exe\",\n            \"regedt32.exe\",\n            \"rescue.exe\",\n            \"rescue32.exe\",\n            \"rrguard.exe\",\n            \"rshell.exe\",\n            \"rtvscn95.exe\",\n            \"rulaunch.exe\",\n            \"run32dll.exe\",\n            \"rundll.exe\",\n            \"rundll16.exe\",\n            \"ruxdll32.exe\",\n            \"safeweb.exe\",\n            \"sahagent.exe\",\n            \"save.exe\",\n            \"savenow.exe\",\n            \"sc.exe\",\n            \"scam32.exe\",\n            \"scan95.exe\",\n            \"scanpm.exe\",\n            \"scrscan.exe\",\n            \"serv95.exe\",\n            \"setup_flowprotector_us.exe\",\n            \"setupvameeval.exe\",\n            \"sfc.exe\",\n            \"sgssfw32.exe\",\n            \"sh.exe\",\n            \"shellspyinstall.exe\",\n            \"shn.exe\",\n            \"showbehind.exe\",\n            \"sms.exe\",\n            \"smss32.exe\",\n            \"soap.exe\",\n            \"sofi.exe\",\n            \"sperm.exe\",\n            \"spf.exe\",\n            \"spoler.exe\",\n            \"spoolcv.exe\",\n            \"spoolsv32.exe\",\n            \"spyxx.exe\",\n            \"srexe.exe\",\n            \"srng.exe\",\n            \"ss3edit.exe\",\n            \"ssg_4104.exe\",\n            \"ssgrate.exe\",\n            \"st2.exe\",\n            \"start.exe\",\n            \"stcloader.exe\",\n            \"supftrl.exe\",\n            \"support.exe\",\n            \"supporter5.exe\",\n            \"svchostc.exe\",\n            \"svchosts.exe\",\n            \"sweep95.exe\",\n            \"sweepnet.sweepsrv.sys.swnetsup.exe\",\n            \"symtray.exe\",\n            \"sysedit.exe\",\n            \"sysupd.exe\",\n            \"taskmg.exe\",\n            \"taskmo.exe\",\n            \"taumon.exe\",\n            \"tbscan.exe\",\n            \"tc.exe\",\n            \"tca.exe\",\n            \"tcm.exe\",\n            \"tds-3.exe\",\n            \"tds2-98.exe\",\n            \"tds2-nt.exe\",\n            \"teekids.exe\",\n            \"tfak.exe\",\n            \"tfak5.exe\",\n            \"tgbob.exe\",\n            \"titanin.exe\",\n            \"titaninxp.exe\",\n            \"tracert.exe\",\n            \"trickler.exe\",\n            \"trjsetup.exe\",\n            \"trojantrap3.exe\",\n            \"tsadbot.exe\",\n            \"tvmd.exe\",\n            \"tvtmd.exe\",\n            \"undoboot.exe\",\n            \"updat.exe\",\n            \"update.exe\",\n            \"upgrad.exe\",\n            \"utpost.exe\",\n            \"vbcons.exe\",\n            \"vbust.exe\",\n            \"vbwin9x.exe\",\n            \"vbwinntw.exe\",\n            \"vcsetup.exe\",\n            \"vet32.exe\",\n            \"vet95.exe\",\n            \"vettray.exe\",\n            \"vfsetup.exe\",\n            \"vir-help.exe\",\n            \"virusmdpersonalfirewall.exe\",\n            \"vnlan300.exe\",\n            \"vnpc3000.exe\",\n            \"vpc42.exe\",\n            \"vpfw30s.exe\",\n            \"vscan40.exe\",\n            \"vscenu6.02d30.exe\",\n            \"vsched.exe\",\n            \"vsecomr.exe\",\n            \"vsisetup.exe\",\n            \"vsmain.exe\",\n            \"vswin9xe.exe\",\n            \"vswinntse.exe\",\n            \"vswinperse.exe\",\n            \"w32dsm89.exe\",\n            \"w9x.exe\",\n            \"watchdog.exe\",\n            \"webdav.exe\",\n            \"wfindv32.exe\",\n            \"whoswatchingme.exe\",\n            \"wimmun32.exe\",\n            \"win-bugsfix.exe\",\n            \"win32.exe\",\n            \"win32us.exe\",\n            \"winactive.exe\",\n            \"window.exe\",\n            \"windows.exe\",\n            \"wininetd.exe\",\n            \"wininitx.exe\",\n            \"winlogin.exe\",\n            \"winmain.exe\",\n            \"winnet.exe\",\n            \"winppr32.exe\",\n            \"winrecon.exe\",\n            \"winservn.exe\",\n            \"winssk32.exe\",\n            \"winstart.exe\",\n            \"winstart001.exe\",\n            \"wintsk32.exe\",\n            \"winupdate.exe\",\n            \"wkufind.exe\",\n            \"wnad.exe\",\n            \"wnt.exe\",\n            \"wradmin.exe\",\n            \"wsbgate.exe\",\n            \"wupdater.exe\",\n            \"wupdt.exe\",\n            \"wyvernworksfirewall.exe\",\n            \"xpf202en.exe\",\n            \"zapsetup3001.exe\",\n            \"zatutor.exe\",\n            \"zonalm2601.exe\",\n            \"A2CMD.exe\",\n            \"ADVCHK.exe\",\n            \"AGB.exe\",\n            \"AKRNL.exe\",\n            \"AHPROCMONSERVER.exe\",\n            \"AIRDEFENSE.exe\",\n            \"ALERTSVC.exe\",\n            \"AVIRA.exe\",\n            \"AMON.exe\",\n            \"TROJAN.exe\",\n            \"AVZ.exe\",\n            \"ANTIVIR.exe\",\n            \"ARMOR2NET.exe\",\n            \"ASH.exeexe.exe\",\n            \"ASHENHCD.exe\",\n            \"ASHMAISV.exe\",\n            \"ASHPOPWZ.exe\",\n            \"ASHSERV.exe\",\n            \"ASHSIMPL.exe\",\n            \"ASHSKPCK.exe\",\n            \"ASHWEBSV.exe\",\n            \"ASWUPDSV.exe\",\n            \"ASWSCAN.exe\",\n            \"AVCIMAN.exe\",\n            \"AVENGINE.exe\",\n            \"AVESVC.exe\",\n            \"AVEVAL.exe\",\n            \"AVEVL32.exe\",\n            \"AVGAM.exe\",\n            \"AVGCC.exe\",\n            \"AVGCHSVX.exe\",\n            \"AVGCSRVX.exe\",\n            \"AVGNSX.exe\",\n            \"AVGCC32.exe\",\n            \"AVGCTRL.exe\",\n            \"AVGFWSRV.exe\",\n            \"AVGNTMGR.exe\",\n            \"AVGTRAY.exe\",\n            \"AVGUPSVC.exe\",\n            \"AVINITNT.exe\",\n            \"AVKSERV.exe\",\n            \"AVKSERVICE.exe\",\n            \"AVP32.exe\",\n            \"AVSERVER.exe\",\n            \"AVSCHED32.exe\",\n            \"AVSYNMGR.exe\",\n            \"AVWUPD32.exe\",\n            \"AVXMONITOR.exe\",\n            \"AVXQUAR.exe\",\n            \"BDSWITCH.exe\",\n            \"BLACKICE.exe\",\n            \"CAFIX.exe\",\n            \"CFP.exe\",\n            \"CFPCONFIG.exe\",\n            \"CFIAUDIT.exe\",\n            \"CLAMWIN.exe\",\n            \"CUREIT.exe\",\n            \"DEFWATCH.exe\",\n            \"DRVIRUS.exe\",\n            \"DRWADINS.exe\",\n            \"DRWEB.exe\",\n            \"DEFENDERDAEMON.exe\",\n            \"DWEBLLIO.exe\",\n            \"DWEBIO.exe\",\n            \"ESCANH95.exe\",\n            \"ESCANHNT.exe\",\n            \"EWIDOCTRL.exe\",\n            \"EZANTIVIRUSREGISTRATIONCHECK.exe\",\n            \"FILEMON.exe\",\n            \"FIREWALL.exe\",\n            \"FORTISCAN.exe\",\n            \"FPWIN.exe\",\n            \"FSBWSYS.exe\",\n            \"F-SCHED.exe\",\n            \"FSDFWD.exe\",\n            \"FSGK32.exe\",\n            \"FSGK32ST.exe\",\n            \"FSGUIEXE.exe\",\n            \"FSPEX.exe\",\n            \"GCASDTSERV.exe\",\n            \"GCASSERV.exe\",\n            \"GIANTANTISPYWARE.exe\",\n            \"GUARDGUI.exe\",\n            \"GUARDNT.exe\",\n            \"HREGMON.exe\",\n            \"HRRES.exe\",\n            \"HSOCKPE.exe\",\n            \"HUPDATE.exe\",\n            \"IAMSERV.exe\",\n            \"ICLOAD95.exe\",\n            \"ICLOADNT.exe\",\n            \"ICMON.exe\",\n            \"ICSSUPPNT.exe\",\n            \"ICSUPP95.exe\",\n            \"ICSUPPNT.exe\",\n            \"INETUPD.exe\",\n            \"INOCIT.exe\",\n            \"INORPC.exe\",\n            \"INORT.exe\",\n            \"INOTASK.exe\",\n            \"INOUPTNG.exe\",\n            \"IOMON98.exe\",\n            \"ISAFE.exe\",\n            \"ISATRAY.exe\",\n            \"KAV.exe\",\n            \"KAVMM.exe\",\n            \"KAVPFW.exe\",\n            \"KAVSTART.exe\",\n            \"KAVSVC.exe\",\n            \"KAVSVCUI.exe\",\n            \"KMAILMON.exe\",\n            \"MAMUTU.exe\",\n            \"MCAGENT.exe\",\n            \"MCREGWIZ.exe\",\n            \"MCUPDATE.exe\",\n            \"MINILOG.exe\",\n            \"MYAGTSVC.exe\",\n            \"MYAGTTRY.exe\",\n            \"NAVLU32.exe\",\n            \"NAVW32.exe\",\n            \"NEOWATCHLOG.exe\",\n            \"NEOWATCHTRAY.exe\",\n            \"NISSERV.exe\",\n            \"NOD32.exe\",\n            \"NORMIST.exe\",\n            \"NOTSTART.exe\",\n            \"NPAVTRAY.exe\",\n            \"NPFMSG.exe\",\n            \"NSCHED32.exe\",\n            \"NSMDTR.exe\",\n            \"NSSSERV.exe\",\n            \"NSSTRAY.exe\",\n            \"NTOS.exe\",\n            \"NTXCONFIG.exe\",\n            \"NUPGRADE.exe\",\n            \"NVCOD.exe\",\n            \"NVCTE.exe\",\n            \"NVCUT.exe\",\n            \"NWSERVICE.exe\",\n            \"OFCPFWSVC.exe\",\n            \"OPSSVC.exe\",\n            \"OP_MON.exe\",\n            \"PAVFIRES.exe\",\n            \"PAVFNSVR.exe\",\n            \"PAVKRE.exe\",\n            \"PAVPROT.exe\",\n            \"PAVPRSRV.exe\",\n            \"PAVSRV51.exe\",\n            \"PAVSS.exe\",\n            \"PCCGUIDE.exe\",\n            \"PCCIOMON.exe\",\n            \"PCCPFW.exe\",\n            \"PCCTLCOM.exe\",\n            \"PERTSK.exe\",\n            \"PERVAC.exe\",\n            \"PESTPATROL.exe\",\n            \"PNMSRV.exe\",\n            \"PREVSRV.exe\",\n            \"PREVX.exe\",\n            \"PSIMSVC.exe\",\n            \"QHONLINE.exe\",\n            \"QHONSVC.exe\",\n            \"QHWSCSVC.exe\",\n            \"QHSET.exe\",\n            \"RTVSCN95.exe\",\n            \"SALITY.exe\",\n            \"SAVADMINSERVICE.exe\",\n            \"SAVSCAN.exe\",\n            \"SCANNINGPROCESS.exe\",\n            \"SDRA64.exe\",\n            \"SDHELP.exe\",\n            \"SITECLI.exe\",\n            \"SPBBCSVC.exe\",\n            \"SPIDERCPL.exe\",\n            \"SPIDERML.exe\",\n            \"SPIDERUI.exe\",\n            \"SPYBOTSD.exe\",\n            \"SPYXX.exe\",\n            \"SS3EDIT.exe\",\n            \"STOPSIGNAV.exe\",\n            \"SWAGENT.exe\",\n            \"SWDOCTOR.exe\",\n            \"SWNETSUP.exe\",\n            \"SYMLCSVC.exe\",\n            \"SYMSPORT.exe\",\n            \"SYMWSC.exe\",\n            \"SYNMGR.exe\",\n            \"TAUMON.exe\",\n            \"TMNTSRV.exe\",\n            \"TMPROXY.exe\",\n            \"TNBUTIL.exe\",\n            \"VBA32ECM.exe\",\n            \"VBA32IFS.exe\",\n            \"VBA32LDR.exe\",\n            \"VBA32PP3.exe\",\n            \"VBSNTW.exe\",\n            \"VCRMON.exe\",\n            \"VRFWSVC.exe\",\n            \"VRRW32.exe\",\n            \"VSECOMR.exe\",\n            \"WATCHDOG.exe\",\n            \"WINSSNOTIFY.exe\",\n            \"XCOMMSVR.exe\",\n            \"ZLCLIENT.exe\",\n            \"navap.exe\",\n            \"sahagent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data文件系统实时监控\": {\n        \"processes\": [\n            \"avkwctl9.exe\",\n            \"AVKWCTL.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Anti-Virus\": {\n        \"processes\": [\n            \"SAVMAIN.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360保险箱\": {\n        \"processes\": [\n            \"safeboxTray.exe\",\n            \"360safebox.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data扫描器\": {\n        \"processes\": [\n            \"GDScan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data杀毒代理\": {\n        \"processes\": [\n            \"AVKProxy.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data备份服务\": {\n        \"processes\": [\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"亚信安全服务器深度安全防护系统\": {\n        \"processes\": [\n            \"Notifier.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云盾\": {\n        \"processes\": [\n            \"AliYunDun.exe\",\n            \"AliYunDunUpdate.exe\",\n            \"aliyun_assist_service.exe\",\n            \"/usr/local/aegis/aegis_client/\"\n        ],\n        \"url\": \"\"\n    },\n    \"腾讯云安全\": {\n        \"processes\": [\n            \"BaradAgent.exe\",\n            \"sgagent.exe\",\n            \"YDService.exe\",\n            \"YDLive.exe\",\n            \"YDEdr.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360主机卫士Web\": {\n        \"processes\": [\n            \"360WebSafe.exe\",\n            \"QHSrv.exe\",\n            \"QHWebshellGuard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"网防G01\": {\n        \"processes\": [\n            \"gov_defence_service.exe\",\n            \"gov_defence_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"云锁客户端\": {\n        \"processes\": [\n            \"PC.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Symantec Shared诺顿邮件防火墙软件\": {\n        \"processes\": [\n            \"SNDSrvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"U盘杀毒专家\": {\n        \"processes\": [\n            \"USBKiller.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天擎EDRAgent\": {\n        \"processes\": [\n            \"360EntClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360(奇安信)天擎\": {\n        \"processes\": [\n            \"360EntMisc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云-云盾\": {\n        \"processes\": [\n            \"alisecguard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos AutoUpdate Service\": {\n        \"processes\": [\n            \"ALsvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云监控\": {\n        \"processes\": [\n            \"CmsGoAgent.windows-amd64.\"\n        ],\n        \"url\": \"\"\n    },\n    \"深信服EDRAgent\": {\n        \"processes\": [\n            \"edr_agent.exe\",\n            \"edr_monitor.exe\",\n            \"edr_sec_plan.exe\"\n        ],\n        \"url\": \"https://edr.sangfor.com.cn\"\n    },\n    \"戎码翼龙 NG-EDR\": {\n        \"processes\": [\n            \"rm_service.exe\",\n            \"rm_live.exe\",\n            \"rm_tray.exe\",\n            \"rm_hips.exe\"\n        ],\n        \"url\": \"https://www.rongma.com\"\n    },\n    \"启明星辰天珣EDRAgent\": {\n        \"processes\": [\n            \"ESAV.exe\",\n            \"ESCCControl.exe\",\n            \"ESCC.exe\",\n            \"ESCCIndex.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"蓝鲸Agent\": {\n        \"processes\": [\n            \"gse_win_agent.exe\",\n            \"gse_win_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"联想电脑管家\": {\n        \"processes\": [\n            \"LAVService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Agent\": {\n        \"processes\": [\n            \"McsAgent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Client\": {\n        \"processes\": [\n            \"McsClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360TotalSecurity(360国际版)\": {\n        \"processes\": [\n            \"QHSafeMain.exe\",\n            \"QHSafeTray.exe\",\n            \"QHWatchdog.exe\",\n            \"QHActiveDefense.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Device Control Service\": {\n        \"processes\": [\n            \"sdcservice.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Endpoint Defense Service\": {\n        \"processes\": [\n            \"SEDService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Windows Defender SmartScreen\": {\n        \"processes\": [\n            \"smartscreen.exe\"\n        ],\n        \"url\": \"https://learn.microsoft.com/zh-cn/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/\"\n    },\n    \"Sophos Clean Service\": {\n        \"processes\": [\n            \"SophosCleanM64.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos FIM\": {\n        \"processes\": [\n            \"SophosFIMService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos System Protection Service\": {\n        \"processes\": [\n            \"SSPService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Web Control Service\": {\n        \"processes\": [\n            \"swc_service.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天眼云镜\": {\n        \"processes\": [\n            \"TitanAgent.exe\",\n            \"TitanMonitor.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天融信终端防御\": {\n        \"processes\": [\n            \"TopsecMain.exe\",\n            \"TopsecTray.exe\"\n        ],\n     ","plugins/README.md":"# FScan 插件开发规范\n\n## 概述\n\nFScan 采用简化的单文件插件架构，每个插件一个 `.go` 文件，消除了过度设计的多文件结构。\n\n\n1. **简洁至上**：消除所有不必要的抽象层\n2. **直击本质**：专注于解决实际问题，不为架构而架构  \n3. **向后兼容**：不破坏用户接口和现有功能\n4. **消除特殊情况**：统一处理逻辑，减少 if/else 分支\n\n## 插件架构\n\n### 核心接口\n\n```go\n// Plugin 插件接口 - 只保留必要的方法\ntype Plugin interface {\n    GetName() string                                        // 插件名称\n    GetPorts() []int                                       // 支持的端口\n    Scan(ctx context.Context, info *common.HostInfo) *ScanResult  // 扫描功能\n}\n\n// 可选接口：如果插件支持利用功能\ntype Exploiter interface {\n    Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult\n}\n```\n\n### 数据结构\n\n```go\n// ScanResult 扫描结果 - 删除所有冗余字段\ntype ScanResult struct {\n    Success  bool   // 扫描是否成功\n    Service  string // 服务类型\n    Username string // 发现的用户名（弱密码）\n    Password string // 发现的密码（弱密码）  \n    Banner   string // 服务版本信息\n    Error    error  // 错误信息（如果失败）\n}\n\n// ExploitResult 利用结果（仅有利用功能的插件需要）\ntype ExploitResult struct {\n    Success bool   // 利用是否成功\n    Output  string // 命令执行输出\n    Error   error  // 错误信息\n}\n\n// Credential 凭据结构\ntype Credential struct {\n    Username string\n    Password string\n    KeyData  []byte // SSH私钥等\n}\n```\n\n## 插件开发模板\n\n### 1. 纯扫描插件（如MySQL）\n\n```go\npackage plugins\n\nimport (\n    \"context\"\n    \"fmt\"\n    // 其他必要导入\n)\n\n// PluginName服务扫描插件\ntype PluginNamePlugin struct {\n    name  string\n    ports []int\n}\n\n// 构造函数\nfunc NewPluginNamePlugin() *PluginNamePlugin {\n    return &PluginNamePlugin{\n        name:  \"plugin_name\",\n        ports: []int{default_port},\n    }\n}\n\n// 实现Plugin接口\nfunc (p *PluginNamePlugin) GetName() string { return p.name }\nfunc (p *PluginNamePlugin) GetPorts() []int { return p.ports }\n\nfunc (p *PluginNamePlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 如果禁用暴力破解，只做服务识别\n    if common.DisableBrute {\n        return p.identifyService(info)\n    }\n\n    // 生成测试凭据\n    credentials := GenerateCredentials(\"plugin_name\")\n    \n    // 逐个测试凭据\n    for _, cred := range credentials {\n        select {\n        case <-ctx.Done():\n            return &ScanResult{Success: false, Error: ctx.Err()}\n        default:\n        }\n\n        if p.testCredential(ctx, info, cred) {\n            return &ScanResult{\n                Success:  true,\n                Service:  \"plugin_name\",\n                Username: cred.Username,\n                Password: cred.Password,\n            }\n        }\n    }\n\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 核心认证逻辑\nfunc (p *PluginNamePlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool {\n    // 实现具体的认证测试逻辑\n    return false\n}\n\n// 服务识别（-nobr模式）\nfunc (p *PluginNamePlugin) identifyService(info *common.HostInfo) *ScanResult {\n    // 实现服务识别逻辑\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 自动注册\nfunc init() {\n    RegisterPlugin(\"plugin_name\", func() Plugin {\n        return NewPluginNamePlugin()\n    })\n}\n```\n\n### 2. 带利用功能的插件（如SSH）\n\n```go\npackage plugins\n\n// SSH插件结构\ntype SSHPlugin struct {\n    name  string\n    ports []int\n}\n\n// 同时实现Plugin和Exploiter接口\nfunc (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 扫描逻辑（同上）\n}\n\nfunc (p *SSHPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult {\n    // 建立SSH连接\n    client, err := p.connectSSH(info, creds)\n    if err != nil {\n        return &ExploitResult{Success: false, Error: err}\n    }\n    defer client.Close()\n\n    // 执行命令或其他利用操作\n    output, err := p.executeCommand(client, \"whoami\")\n    return &ExploitResult{\n        Success: err == nil,\n        Output:  output,\n        Error:   err,\n    }\n}\n\n// 辅助方法\nfunc (p *SSHPlugin) connectSSH(info *common.HostInfo, creds Credential) (*ssh.Client, error) {\n    // SSH连接实现\n}\n\nfunc (p *SSHPlugin) executeCommand(client *ssh.Client, cmd string) (string, error) {\n    // 命令执行实现\n}\n```\n\n## 开发规范\n\n### 文件组织\n\n```\nplugins/\n├── base.go           # 核心接口和注册系统\n├── mysql.go          # MySQL插件\n├── ssh.go            # SSH插件  \n├── redis.go          # Redis插件\n└── README.md         # 开发文档（本文件）\n```\n\n### 命名规范\n\n- **插件文件**：`{service_name}.go`\n- **插件结构体**：`{ServiceName}Plugin`\n- **构造函数**：`New{ServiceName}Plugin()`\n- **插件名称**：小写，与文件名一致\n\n### 代码规范\n\n1. **错误处理**：始终使用Context进行超时控制\n2. **日志输出**：成功时使用 `common.LogSuccess`，调试用 `common.LogDebug`\n3. **凭据生成**：使用 `GenerateCredentials(service_name)` 生成测试凭据\n4. **资源管理**：及时关闭连接，使用 defer 确保清理\n\n### 测试要求\n\n每个插件必须支持：\n\n1. **暴力破解模式**：`common.DisableBrute = false`\n2. **服务识别模式**：`common.DisableBrute = true`\n3. **Context超时处理**：正确响应 `ctx.Done()`\n4. **代理支持**：如果 `common.Socks5Proxy` 不为空\n\n## 迁移指南\n\n### 从三文件架构迁移\n\n1. **提取核心逻辑**：从 connector.go 提取认证逻辑\n2. **合并实现**：将 plugin.go 中的组装逻辑内联\n3. **删除垃圾**：删除空的 exploiter.go\n4. **简化数据结构**：只保留必要的字段\n\n### 从Legacy插件迁移\n\n1. **保留核心逻辑**：复制扫描和认证的核心算法\n2. **标准化接口**：实现统一的Plugin接口  \n3. **移除全局依赖**：通过返回值而不是全局变量传递结果\n4. **统一日志**：使用统一的日志接口\n\n## 性能优化\n\n1. **连接复用**：在同一次扫描中复用连接\n2. **内存管理**：及时释放不需要的资源\n3. **并发控制**：通过Context控制并发度\n4. **超时设置**：合理设置各阶段超时时间\n\n## 示例\n\n参考 `mysql.go` 作为标准的纯扫描插件实现\n参考 `ssh.go` 作为带利用功能的插件实现\n\n---\n\n**记住：好的代码不是写出来的，是重构出来的。消除所有不必要的复杂性，直击问题本质。**","plugins/services/README.md":"# 服务扫描插件目录\n\n本目录包含所有服务扫描插件，采用简化的单文件插件架构。\n\n## 已实现插件\n\n### 数据库服务\n- `mysql.go` - MySQL数据库扫描\n- `postgresql.go` - PostgreSQL数据库扫描  \n- `redis.go` - Redis内存数据库扫描\n- `mongodb.go` - MongoDB文档数据库扫描\n- `mssql.go` - Microsoft SQL Server扫描\n- `oracle.go` - Oracle数据库扫描\n- `memcached.go` - Memcached缓存扫描\n- `neo4j.go` - Neo4j图数据库扫描\n\n### 消息队列服务\n- `rabbitmq.go` - RabbitMQ消息队列扫描\n- `activemq.go` - ActiveMQ消息队列扫描\n- `kafka.go` - Apache Kafka扫描\n\n### 网络服务\n- `ssh.go` - SSH远程登录服务扫描\n- `ftp.go` - FTP文件传输服务扫描\n- `telnet.go` - Telnet远程终端服务扫描\n- `smtp.go` - SMTP邮件服务扫描\n- `snmp.go` - SNMP网络管理协议扫描\n- `ldap.go` - LDAP目录服务扫描\n- `rsync.go` - Rsync文件同步服务扫描\n\n### Windows服务\n- `findnet.go` - Windows网络发现插件 (RPC端点映射)\n- `smbinfo.go` - SMB协议信息收集插件\n\n### 其他服务\n- `vnc.go` - VNC远程桌面服务扫描\n- `cassandra.go` - Apache Cassandra数据库扫描\n\n## 插件特性\n\n每个插件都包含：\n- ✅ 服务识别功能\n- ✅ 弱密码检测功能\n- ✅ 完整的利用功能\n- ✅ 错误处理和超时控制\n- ✅ 统一的结果输出格式\n\n## 开发规范\n\n所有插件都遵循 `../README.md` 中定义的开发规范。"},"items":[{"name":"auto.json","path":"plugins/local/auto.json","rawUrl":"https://raw.githubusercontent.com/shadow1ng/fscan/HEAD/plugins/local/auto.json","title":"Local Skill","category":"anthropic-skill","format":"json","content":"{\n    \"ALYac\": {\n        \"processes\": [\n            \"aylaunch.exe\",\n            \"ayupdate2.exe\",\n            \"AYRTSrv.exe\",\n            \"AYAgent.exe\"\n        ],\n        \"url\": \"https://en.estsecurity.com/\"\n    },\n    \"AVG\": {\n        \"processes\": [\n            \"AVGSvc.exe\",\n            \"AVGUI.exe\",\n            \"avgwdsvc.exe\",\n            \"avg.exe\",\n            \"avgaurd.exe\",\n            \"avgemc.exe\",\n            \"avgrsx.exe\",\n            \"avgserv.exe\",\n            \"avgw.exe\"\n        ],\n        \"url\": \"https://www.avg.com/\"\n    },\n    \"Acronis\": {\n        \"processes\": [\n            \"arsm.exe\",\n            \"acronis_license_service.exe\"\n        ],\n        \"url\": \"https://www.acronis.com/\"\n    },\n    \"Ad-Aware\": {\n        \"processes\": [\n            \"AdAwareService.exe\",\n            \"Ad-Aware.exe\",\n            \"AdAware.exe\"\n        ],\n        \"url\": \"https://www.adaware.com/\"\n    },\n    \"AhnLab-V3\": {\n        \"processes\": [\n            \"patray.exe\",\n            \"V3Svc.exe\"\n        ],\n        \"url\": \"https://global.ahnlab.com/site/main.do\"\n    },\n    \"Arcabit\": {\n        \"processes\": [\n            \"arcavir.exe\",\n            \"arcadc.exe\",\n            \"ArcaVirMaster.exe\",\n            \"ArcaMainSV.exe\",\n            \"ArcaTasksService.exe\"\n        ],\n        \"url\": \"https://www.arcabit.pl\"\n    },\n    \"Avast\": {\n        \"processes\": [\n            \"ashDisp.exe\",\n            \"AvastUI.exe\",\n            \"AvastSvc.exe\",\n            \"AvastBrowser.exe\",\n            \"AfwServ.exe\"\n        ],\n        \"url\": \"https://www.avast.com\"\n    },\n    \"Avira AntiVirus(小红伞)\": {\n        \"processes\": [\n            \"avcenter.exe\",\n            \"avguard.exe\",\n            \"avgnt.exe\",\n            \"sched.exe\"\n        ],\n        \"url\": \"https://www.avira.com/\"\n    },\n    \"Baidu AntiVirus\": {\n        \"processes\": [\n            \"BaiduSdSvc.exe\",\n            \"BaiduSdTray.exe\",\n            \"BaiduSd.exe\",\n            \"bddownloader.exe\",\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"https://anquan.baidu.com/\"\n    },\n    \"BitDefender\": {\n        \"processes\": [\n            \"Bdagent.exe\",\n            \"BitDefenderCom.exe\",\n            \"vsserv.exe\",\n            \"bdredline.exe\",\n            \"secenter.exe\",\n            \"bdservicehost.exe\",\n            \"BITDEFENDER.exe\"\n        ],\n        \"url\": \"http://www.bitdefender.com/\"\n    },\n    \"Bkav\": {\n        \"processes\": [\n            \"BKavService.exe\",\n            \"Bka.exe\",\n            \"BkavUtil.exe\",\n            \"BLuPro.exe\"\n        ],\n        \"url\": \"https://www.bkav.com/\"\n    },\n    \"CAT-QuickHeal\": {\n        \"processes\": [\n            \"QUHLPSVC.exe\",\n            \"onlinent.exe\",\n            \"sapissvc.exe\",\n            \"scanwscs.exe\"\n        ],\n        \"url\": \"https://www.quickheal.com/\"\n    },\n    \"CMC\": {\n        \"processes\": [\n            \"CMCTrayIcon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/\"\n    },\n    \"ClamAV\": {\n        \"processes\": [\n            \"freshclam.exe\"\n        ],\n        \"url\": \"https://www.clamav.net\"\n    },\n    \"Comodo\": {\n        \"processes\": [\n            \"cpf.exe\",\n            \"cavwp.exe\",\n            \"ccavsrv.exe\",\n            \"cmdvirth.exe\"\n        ],\n        \"url\": \"https://www.comodo.com\"\n    },\n    \"CrowdStrike Falcon(猎鹰)\": {\n        \"processes\": [\n            \"csfalconservice.exe\",\n            \"CSFalconContainer.exe\"\n        ],\n        \"url\": \"https://www.crowdstrike.com\"\n    },\n    \"Cybereason\": {\n        \"processes\": [\n            \"CybereasonRansomFree.exe\",\n            \"CybereasonRansomFreeServiceHost.exe\",\n            \"CybereasonAV.exe\"\n        ],\n        \"url\": \"https://www.cybereason.com/\"\n    },\n    \"Cylance\": {\n        \"processes\": [\n            \"CylanceSvc.exe\"\n        ],\n        \"url\": \"https://www.cylance.com\"\n    },\n    \"Cyren\": {\n        \"processes\": [\n            \"vsedsps.exe\",\n            \"vseamps.exe\",\n            \"vseqrts.exe\"\n        ],\n        \"url\": \"http://www.cyren.com/\"\n    },\n    \"DrWeb\": {\n        \"processes\": [\n            \"drwebcom.exe\",\n            \"spidernt.exe\",\n            \"drwebscd.exe\",\n            \"drweb32w.exe\",\n            \"dwengine.exes\"\n        ],\n        \"url\": \"https://www.drweb.com/\"\n    },\n    \"Elastic Security\": {\n        \"processes\": [\n            \"elastic-endpoint.exe\",\n            \"elastic-agent.exe\",\n            \"agentbeat.exe\",\n            \"winlogbeat.exe\"\n        ],\n        \"url\": \"https://www.elastic.co/endpoint-detection-response\"\n    },\n    \"ESET-NOD32\": {\n        \"processes\": [\n            \"egui.exe\",\n            \"ecls.exe\",\n            \"ekrn.exe\",\n            \"eguiProxy.exe\",\n            \"EShaSrv.exe\"\n        ],\n        \"url\": \"https://www.eset.com/us/home/antivirus/\"\n    },\n    \"Trend Micro（趋势科技）\": {\n        \"processes\": [\n            \"tmpfw.exe\",\n            \"tmlisten.exe\",\n            \"coreServiceShell.exe\",\n            \"coreFrameworkHost.exe\",\n            \"uiWatchDog.exe\",\n            \"TMLISTEN.exe\"\n        ],\n        \"url\": \"https://www.trendmicro.com\"\n    },\n    \"Emsisoft\": {\n        \"processes\": [\n            \"a2guard.exe\",\n            \"a2free.exe\",\n            \"a2service.exe\"\n        ],\n        \"url\": \"https://www.emsisoft.com/\"\n    },\n    \"Endgame\": {\n        \"processes\": [\n            \"endgame.exe\"\n        ],\n        \"url\": \"https://www.endgame.com/\"\n    },\n    \"F-Prot\": {\n        \"processes\": [\n            \"F-PROT.exe\",\n            \"FProtTray.exe\",\n            \"FPAVServer.exe\",\n            \"f-stopw.exe\",\n            \"f-prot95.exe\",\n            \"f-agnt95.exe\"\n        ],\n        \"url\": \"http://f-prot.com/\"\n    },\n    \"F-Secure\": {\n        \"processes\": [\n            \"f-secure.exe\",\n            \"fssm32.exe\",\n            \"Fsorsp64.exe\",\n            \"fsavgui.exe\",\n            \"fameh32.exe\",\n            \"fch32.exe\",\n            \"fih32.exe\",\n            \"fnrb32.exe\",\n            \"fsav32.exe\",\n            \"fsma32.exe\",\n            \"fsmb32.exe\"\n        ],\n        \"url\": \"https://www.f-secure.com\"\n    },\n    \"FireEye(火眼)\": {\n        \"processes\": [\n            \"xagtnotif.exe\",\n            \"xagt.exe\"\n        ],\n        \"url\": \"https://www.fireeye.com\"\n    },\n    \"Trellix EDR(McAfee && 火眼)\": {\n        \"processes\": [\n            \"macmnsvc.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcshield.exe\",\n            \"mctray.exe\",\n            \"mfeatp.exe\",\n            \"mfeensppl.exe\",\n            \"mfeesp.exe\",\n            \"mfefw.exe\",\n            \"mfehcs.exe\",\n            \"mfemactl.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfevtps.exe\",\n            \"mfewch.exe\",\n            \"updaterui.exe\"\n        ],\n        \"url\": \"https://www.trellix.com\"\n    },\n    \"Fortinet（飞塔）\": {\n        \"processes\": [\n            \"FortiClient.exe\",\n            \"FortiTray.exe\",\n            \"FortiScand.exe\",\n            \"FortiWF.exe\",\n            \"FortiProxy.exe\",\n            \"FortiESNAC.exe\",\n            \"FortiSSLVPNdaemon.exe\",\n            \"FortiTcs.exe\",\n            \"FctSecSvr.exe\"\n        ],\n        \"url\": \"https://fortiguard.com/\"\n    },\n    \"GData\": {\n        \"processes\": [\n            \"AVK.exe\",\n            \"avkcl.exe\",\n            \"avkpop.exe\",\n            \"avkservice.exe\",\n            \"GDScan.exe\",\n            \"AVKWCtl.exe\",\n            \"AVKProxy.exe\",\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"https://www.gdatasoftware.com/\"\n    },\n    \"Ikarus\": {\n        \"processes\": [\n            \"guardxservice.exe\",\n            \"guardxkickoff.exe\"\n        ],\n        \"url\": \"https://www.ikarussecurity.com/\"\n    },\n    \"Jiangmin\": {\n        \"processes\": [\n            \"KVFW.exe\",\n            \"KVsrvXP.exe\",\n            \"KVMonXP.exe\",\n            \"KVwsc.exe\"\n        ],\n        \"url\": \"https://www.jiangmin.com/\"\n    },\n    \"K7AntiVirus\": {\n        \"processes\": [\n            \"K7TSecurity.exe\",\n            \"K7TSMain.Exe\",\n            \"K7TSUpdT.exe\"\n        ],\n        \"url\": \"http://viruslab.k7computing.com/\"\n    },\n    \"Kaspersky(卡巴斯基)\": {\n        \"processes\": [\n            \"avp.exe\",\n            \"avpcc.exe\",\n            \"avpm.exe\",\n            \"kavpf.exe\",\n            \"kavfs.exe\",\n            \"klnagent.exe\",\n            \"kavtray.exe\",\n            \"kavfswp.exe\",\n            \"kaspersky.exe\"\n        ],\n        \"url\": \"https://www.kaspersky.com\"\n    },\n    \"Max Secure Software\": {\n        \"processes\": [\n            \"SDSystemTray.exe\",\n            \"MaxRCSystemTray.exe\",\n            \"RCSystemTray.exe\",\n            \"MaxAVPlusDM.exe\",\n            \"LiveUpdateSD.exe\"\n        ],\n        \"url\": \"https://www.maxpcsecure.com/\"\n    },\n    \"Malwarebytes\": {\n        \"processes\": [\n            \"MBAMService.exe\",\n            \"mbam.exe\",\n            \"mbamtray.exe\"\n        ],\n        \"url\": \"https://www.malwarebytes.com/\"\n    },\n    \"McAfee(迈克菲-可能为Trellix)\": {\n        \"processes\": [\n            \"Mcshield.exe\",\n            \"Tbmon.exe\",\n            \"Frameworkservice.exe\",\n            \"firesvc.exe\",\n            \"firetray.exe\",\n            \"hipsvc.exe\",\n            \"mfevtps.exe\",\n            \"mcafeefire.exe\",\n            \"shstat.exe\",\n            \"vstskmgr.exe\",\n            \"engineserver.exe\",\n            \"alogserv.exe\",\n            \"avconsol.exe\",\n            \"cmgrdian.exe\",\n            \"cpd.exe\",\n            \"mcmnhdlr.exe\",\n            \"mcvsshld.exe\",\n            \"mcvsrte.exe\",\n            \"mghtml.exe\",\n            \"mpfservice.exe\",\n            \"mpfagent.exe\",\n            \"mpftray.exe\",\n            \"vshwin32.exe\",\n            \"vsstat.exe\",\n            \"guarddog.exe\",\n            \"mfeann.exe\",\n            \"udaterui.exe\",\n            \"naprdmgr.exe\",\n            \"mctray.exe\",\n            \"fcagate.exe\",\n            \"fcag.exe\",\n            \"fcags.exe\",\n            \"fcagswd.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcamnsvc.exe\",\n            \"mctary.exe\",\n            \"mfecanary.exe\",\n            \"mfeconsole.exe\",\n            \"mfeesp.exe\",\n            \"mfefire.exe\",\n            \"mfefw.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfewc.exe\",\n            \"mfewch.exe\"\n        ],\n        \"url\": \"https://www.mcafee.com/en-us\"\n    },\n    \"Microsoft Defender(Windows Defender)\": {\n        \"processes\": [\n            \"MsMpEng.exe\",\n            \"msseces.exe\",\n            \"mssecess.exe\",\n            \"emet_agent.exe\",\n            \"emet_service.exe\",\n            \"drwatson.exe\",\n            \"MpCmdRun.exe\",\n            \"NisSrv.exe\",\n            \"MsSense.exe\",\n            \"MSASCui.exe\",\n            \"MSASCuiL.exe\",\n            \"SecurityHealthService.exe\"\n        ],\n        \"url\": \"https://www.microsoft.com/en-us/windows/comprehensive-security\"\n    },\n    \"NANO-Antivirus\": {\n        \"processes\": [\n            \"nanoav.exe\",\n            \"nanoav64.exe\",\n            \"nanoreport.exe\",\n            \"nanoreportc.exe\",\n            \"nanoreportc64.exe\",\n            \"nanorst.exe\",\n            \"nanosvc.exe\"\n        ],\n        \"url\": \"https://nano-av.com/\"\n    },\n    \"Palo Alto Networks\": {\n        \"processes\": [\n            \"PanInstaller.exe\"\n        ],\n        \"url\": \"https://www.paloaltonetworks.com/\"\n    },\n    \"Panda Security\": {\n        \"processes\": [\n            \"remupd.exe\",\n            \"apvxdwin.exe\",\n            \"pavproxy.exe\",\n            \"pavsched.exe\"\n        ],\n        \"url\": \"https://www.pandasecurity.com/\"\n    },\n    \"Qihoo-360\": {\n        \"processes\": [\n            \"360sd.exe\",\n            \"360tray.exe\",\n            \"ZhuDongFangYu.exe\",\n            \"360rp.exe\",\n            \"360rps.exe\",\n            \"360safe.exe\",\n            \"360safebox.exe\",\n            \"QHActiveDefense.exe\",\n            \"360skylarsvc.exe\",\n            \"LiveUpdate360.exe\"\n        ],\n        \"url\": \"https://sd.360.cn/\"\n    },\n    \"Rising\": {\n        \"processes\": [\n            \"RavMonD.exe\",\n            \"rfwmain.exe\",\n            \"RsMgrSvc.exe\",\n            \"RavMon.exe\"\n        ],\n        \"url\": \"http://antivirus.rising.com.cn/\"\n    },\n    \"SUPERAntiSpyware\": {\n        \"processes\": [\n            \"superantispyware.exe\",\n            \"sascore.exe\",\n            \"SAdBlock.exe\",\n            \"sabsvc.exe\"\n        ],\n        \"url\": \"http://www.superadblocker.com/\"\n    },\n    \"SecureAge APEX\": {\n        \"processes\": [\n            \"UniversalAVService.exe\",\n            \"EverythingServer.exe\",\n            \"clamd.exe\"\n        ],\n        \"url\": \"https://www.secureage.com/\"\n    },\n    \"Sophos AV\": {\n        \"processes\": [\n            \"SavProgress.exe\",\n            \"icmon.exe\",\n            \"SavMain.exe\",\n            \"SophosUI.exe\",\n            \"SophosFS.exe\",\n            \"SophosHealth.exe\",\n            \"SophosSafestore64.exe\",\n            \"SophosCleanM.exe\",\n            \"SophosFileScanner.exe\",\n            \"SophosNtpService.exe\",\n            \"SophosOsquery.exe\",\n            \"Sophos UI.exe\"\n        ],\n        \"url\": \"https://www.sophos.com/\"\n    },\n    \"TACHYON\": {\n        \"processes\": [],\n        \"url\": \"https://www.tachyonlab.com/en/index.html\"\n    },\n    \"Tencent\": {\n        \"processes\": [\n            \"QQPCRTP.exe\",\n            \"QQPCTray.exe\",\n            \"QQPCMgr.exe\",\n            \"QQPCNetFlow.exe\",\n            \"QQPCRealTimeSpeedup.exe\"\n        ],\n        \"url\": \"https://guanjia.qq.com\"\n    },\n    \"TotalDefense\": {\n        \"processes\": [\n            \"AMRT.exe\",\n            \"SWatcherSrv.exe\",\n            \"Prd.ManagementConsole.exe\"\n        ],\n        \"url\": \"https://www.totaldefense.com\"\n    },\n    \"Trapmine\": {\n        \"processes\": [\n            \"TrapmineEnterpriseService.exe\",\n            \"TrapmineEnterpriseConfig.exe\",\n            \"TrapmineDeployer.exe\",\n            \"TrapmineUpgradeService.exe\"\n        ],\n        \"url\": \"https://trapmine.com/\"\n    },\n    \"TrendMicro\": {\n        \"processes\": [\n            \"TMBMSRV.exe\",\n            \"ntrtscan.exe\",\n            \"Pop3Trap.exe\",\n            \"WebTrap.exe\",\n            \"PccNTMon.exe\"\n        ],\n        \"url\": \"http://careers.trendmicro.com.cn/\"\n    },\n    \"VIPRE\": {\n        \"processes\": [\n            \"SBAMSvc.exe\",\n            \"VipreEdgeProtection.exe\",\n            \"SBAMTray.exe\"\n        ],\n        \"url\": \"https://www.vipre.com\"\n    },\n    \"ViRobot\": {\n        \"processes\": [\n            \"vrmonnt.exe\",\n            \"vrmonsvc.exe\",\n            \"Vrproxyd.exe\"\n        ],\n        \"url\": \"http://www.hauri.net/\"\n    },\n    \"Webroot\": {\n        \"processes\": [\n            \"npwebroot.exe\",\n            \"WRSA.exe\",\n            \"spysweeperui.exe\"\n        ],\n        \"url\": \"https://www.webroot.com/us/en\"\n    },\n    \"Yandex\": {\n        \"processes\": [\n            \"Yandex.exe\",\n            \"YandexDisk.exe\",\n            \"yandesk.exe\"\n        ],\n        \"url\": \"https://yandex.com/support/common/security/antiviruses-free.html\"\n    },\n    \"Zillya\": {\n        \"processes\": [\n            \"zillya.exe\",\n            \"ZAVAux.exe\",\n            \"ZAVCore.exe\"\n        ],\n        \"url\": \"https://zillya.com\"\n    },\n    \"ZoneAlarm\": {\n        \"processes\": [\n            \"vsmon.exe\",\n            \"zapro.exe\",\n            \"zonealarm.exe\"\n        ],\n        \"url\": \"https://www.zonealarm.com/\"\n    },\n    \"Zoner\": {\n        \"processes\": [\n            \"ZPSTray.exe\"\n        ],\n        \"url\": \"https://zonerantivirus.com/\"\n    },\n    \"eGambit\": {\n        \"processes\": [\n            \"dasc.exe\",\n            \"memscan64.exe\",\n            \"dastray.exe\"\n        ],\n        \"url\": \"https://egambit.app/en/\"\n    },\n    \"eScan\": {\n        \"processes\": [\n            \"consctl.exe\",\n            \"mwaser.exe\",\n            \"avpmapp.exe\"\n        ],\n        \"url\": \"https://www.escanav.com/\"\n    },\n    \"Lavasoft\": {\n        \"processes\": [\n            \"AAWTray.exe\",\n            \"LavasoftTcpService.exe\",\n            \"AdAwareTray.exe\",\n            \"WebCompanion.exe\",\n            \"WebCompanionInstaller.exe\",\n            \"adawarebp.exe\",\n            \"ad-watch.exe\"\n        ],\n        \"url\": \"https://www.lavasoft.com/\"\n    },\n    \"The Cleaner\": {\n        \"processes\": [\n            \"cleaner8.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"VBA32\": {\n        \"processes\": [\n            \"vba32lder.exe\"\n        ],\n        \"url\": \"http://www.anti-virus.by/en/index.shtml\"\n    },\n    \"Mongoosa\": {\n        \"processes\": [\n            \"MongoosaGUI.exe\",\n            \"mongoose.exe\"\n        ],\n        \"url\": \"https://www.securitymongoose.com/\"\n    },\n    \"Coranti2012\": {\n        \"processes\": [\n            \"CorantiControlCenter32.exe\"\n        ],\n        \"url\": \"https://www.coranti.com\"\n    },\n    \"UnThreat\": {\n        \"processes\": [\n            \"UnThreat.exe\",\n            \"utsvc.exe\"\n        ],\n        \"url\": \"https://softplanet.com/UnThreat-AntiVirus\"\n    },\n    \"Shield Antivirus\": {\n        \"processes\": [\n            \"CKSoftShiedAntivirus4.exe\",\n            \"shieldtray.exe\"\n        ],\n        \"url\": \"https://shieldapps.com/supportmain/shield-antivirus-support/\"\n    },\n    \"VIRUSfighter\": {\n        \"processes\": [\n            \"AVWatchService.exe\",\n            \"vfproTray.exe\"\n        ],\n        \"url\": \"https://www.spamfighter.com/VIRUSfighter/\"\n    },\n    \"Immunet\": {\n        \"processes\": [\n            \"iptray.exe\"\n        ],\n        \"url\": \"https://www.immunet.com/index\"\n    },\n    \"PSafe\": {\n        \"processes\": [\n            \"PSafeSysTray.exe\",\n            \"PSafeCategoryFinder.exe\",\n            \"psafesvc.exe\"\n        ],\n        \"url\": \"https://www.psafe.com/\"\n    },\n    \"nProtect\": {\n        \"processes\": [\n            \"nspupsvc.exe\",\n            \"Npkcmsvc.exe\",\n            \"npnj5Agent.exe\"\n        ],\n        \"url\": \"http://nos.nprotect.com/\"\n    },\n    \"Spyware Terminator\": {\n        \"processes\": [\n            \"SpywareTerminatorShield.exe\",\n            \"SpywareTerminator.exe\"\n        ],\n        \"url\": \"http://www.spywareterminator.com/Default.aspx\"\n    },\n    \"Norton（赛门铁克）\": {\n        \"processes\": [\n            \"ccSvcHst.exe\",\n            \"rtvscan.exe\",\n            \"ccapp.exe\",\n            \"NPFMntor.exe\",\n            \"ccRegVfy.exe\",\n            \"vptray.exe\",\n            \"iamapp.exe\",\n            \"nav.exe\",\n            \"navapw32.exe\",\n            \"navapsvc.exe\",\n            \"nisum.exe\",\n            \"nmain.exe\",\n            \"nprotect.exe\",\n            \"smcGui.exe\",\n            \"ns.exe\",\n            \"nortonsecurity.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n        \"Norton V25（Avast）\": {\n        \"processes\": [\n            \"afwServ.exe\",\n            \"aswEngSrv.exe\",\n            \"aswidsagent.exe\",\n            \"AvDump.exe\",\n            \"nllToolsSvc.exe\",\n            \"NortonSvc.exe\",\n            \"wsc_proxy.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n    \"Symantec（赛门铁克）\": {\n        \"processes\": [\n            \"ccSetMgr.exe\",\n            \"ccapp.exe\",\n            \"vptray.exe\",\n            \"ccpxysvc.exe\",\n            \"cfgwiz.exe\",\n            \"smc.exe\",\n            \"symproxysvc.exe\",\n            \"vpc32.exe\",\n            \"lsetup.exe\",\n            \"luall.exe\",\n            \"lucomserver.exe\",\n            \"sbserv.exe\",\n            \"ccEvtMgr.exe\",\n            \"smcGui.exe\",\n            \"snac.exe\",\n            \"SymCorpUI.exe\",\n            \"sepWscSvc64.exe\"\n        ],\n        \"url\": \"http://www.symantec.com/\"\n    },\n    \"可牛杀毒\": {\n        \"processes\": [\n            \"knsdtray.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E5%8F%AF%E7%89%9B%E5%85%8D%E8%B4%B9%E6%9D%80%E6%AF%92%E8%BD%AF%E4%BB%B6\"\n    },\n    \"流量矿石\": {\n        \"processes\": [\n            \"Miner.exe\"\n        ],\n        \"url\": \"https://jiaoyi.yunfan.com/\"\n    },\n    \"SafeDog(安全狗)\": {\n        \"processes\": [\n            \"safedog.exe\",\n            \"SafeDogGuardCenter.exe\",\n            \"SafeDogSiteIIS.exe\",\n            \"SafeDogTray.exe\",\n            \"SafeDogServerUI.exe\",\n            \"SafeDogSiteApache.exe\",\n            \"CloudHelper.exe\",\n            \"SafeDogUpdateCenter.exe\"\n        ],\n        \"url\": \"http://www.safedog.cn/\"\n    },\n    \"木马克星\": {\n        \"processes\": [\n            \"parmor.exe\",\n            \"Iparmor.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E6%9C%A8%E9%A9%AC%E5%85%8B%E6%98%9F/2979824?fr=aladdin\"\n    },\n    \"贝壳云安全\": {\n        \"processes\": [\n            \"beikesan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"木马猎手\": {\n        \"processes\": [\n            \"TrojanHunter.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"巨盾网游安全盾\": {\n        \"processes\": [\n            \"GG.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"绿鹰安全精灵\": {\n        \"processes\": [\n            \"adam.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E7%BB%BF%E9%B9%B0%E5%AE%89%E5%85%A8%E7%B2%BE%E7%81%B5\"\n    },\n    \"超级巡警\": {\n        \"processes\": [\n            \"AST.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"墨者安全专家\": {\n        \"processes\": [\n            \"ananwidget.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"风云防火墙\": {\n        \"processes\": [\n            \"FYFireWall.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"微点主动防御\": {\n        \"processes\": [\n            \"MPMon.exe\"\n        ],\n        \"url\": \"http://www.micropoint.com.cn/\"\n    },\n    \"天网防火墙\": {\n        \"processes\": [\n            \"pfw.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"D 盾\": {\n        \"processes\": [\n            \"D_Safe_Manage.exe\",\n            \"d_manage.exe\"\n        ],\n        \"url\": \"http://www.d99net.net/\"\n    },\n    \"云锁\": {\n        \"processes\": [\n            \"yunsuo_agent_service.exe\",\n            \"yunsuo_agent_daemon.exe\"\n        ],\n        \"url\": \"https://www.yunsuo.com.cn/\"\n    },\n    \"护卫神\": {\n        \"processes\": [\n            \"HwsPanel.exe\",\n            \"hws_ui.exe\",\n            \"hws.exe\",\n            \"hwsd.exe\",\n            \"HwsHostPanel.exe\",\n            \"HwsHostMaster.exe\"\n        ],\n        \"url\": \"https://www.hws.com/\"\n    },\n    \"火绒安全\": {\n        \"processes\": [\n            \"hipstray.exe\",\n            \"wsctrl.exe\",\n            \"usysdiag.exe\",\n            \"HipsDaemon.exe\",\n            \"HipsLog.exe\",\n            \"HipsMain.exe\",\n            \"wsctrlsvc.exe\"\n        ],\n        \"url\": \"https://www.huorong.cn/\"\n    },\n    \"网络病毒克星\": {\n        \"processes\": [\n            \"WEBSCANX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"SPHINX防火墙\": {\n        \"processes\": [\n            \"SPHINX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"奇安信天擎\": {\n        \"processes\": [\n            \"TQClient.exe\",\n            \"TQTray.exe\",\n            \"QaxEngManager.exe\",\n            \"TQDefender.exe\"\n        ],\n        \"url\": \"https://www.qianxin.com/product/detail/pid/330\"\n    },\n    \"H+BEDV Datentechnik GmbH\": {\n        \"processes\": [\n            \"avwin.exe\",\n            \"avwupsrv.exe\"\n        ],\n        \"url\": \"http://www.free-av.com/\"\n    },\n    \"IBM ISS Proventia\": {\n        \"processes\": [\n            \"blackd.exe\",\n            \"rapapp.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"eEye Digital Security\": {\n        \"processes\": [\n            \"eeyeevnt.exe\",\n            \"blink.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"TamoSoft\": {\n        \"processes\": [\n            \"cv.exe\",\n            \"ent.exe\"\n        ],\n        \"url\": \"https://www.tamos.com/\"\n    },\n    \"Kerio Personal Firewall\": {\n        \"processes\": [\n            \"persfw.exe\",\n            \"wrctrl.exe\"\n        ],\n        \"url\": \"http://www.kerio.com/\"\n    },\n    \"Simplysup\": {\n        \"processes\": [\n            \"Trjscan.exe\"\n        ],\n        \"url\": \"https://www.simplysup.com/\"\n    },\n    \"PC Tools AntiVirus\": {\n        \"processes\": [\n            \"PCTAV.exe\",\n            \"pctsGui.exe\"\n        ],\n        \"url\": \"http://www.pctools.com\"\n    },\n    \"VirusBuster Professional\": {\n        \"processes\": [\n            \"vbcmserv.exe\"\n        ],\n        \"url\": \"http://www.virusbuster.hu\"\n    },\n    \"ClamWin\": {\n        \"processes\": [\n            \"ClamTray.exe\",\n            \"clamscan.exe\"\n        ],\n        \"url\": \"http://www.clamwin.com/\"\n    },\n    \"安天智甲\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kscan.exe\",\n            \"AMediumManager.exe\",\n            \"kismain.exe\"\n        ],\n        \"url\": \"https://antiy.cn/\"\n    },\n    \"CMC Endpoint Security\": {\n        \"processes\": [\n            \"CMCNECore.exe\",\n            \"cmcepagent.exe\",\n            \"cmccore.exe\",\n            \"CMCLog.exe\",\n            \"CMCFMon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/giai-phap/\"\n    },\n    \"金山毒霸\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kxescore.exe\",\n            \"kupdata.exe\",\n            \"kwsprotect64.exe\",\n            \"kislive.exe\",\n            \"knewvip.exe\",\n            \"kscan.exe\",\n            \"kxecenter.exe\",\n            \"kxemain.exe\",\n            \"KWatch.exe\",\n            \"KSafeSvc.exe\",\n            \"KSafeTray.exe\"\n        ],\n        \"url\": \"http://www.ijinshan.com/\"\n    },\n    \"Agnitum outpost (Outpost Firewall)\": {\n        \"processes\": [\n            \"outpost.exe\",\n            \"acs.exe\"\n        ],\n        \"url\": \"https://agnitum-outpost-security-suite.en.softonic.com/\"\n    },\n    \"Cynet\": {\n        \"processes\": [\n            \"CynetLauncher.exe\",\n            \"CynetDS.exe\",\n            \"CynetEPS.exe\",\n            \"CynetMS.exe\",\n            \"CynetAR.exe\",\n            \"CynetGW.exe\",\n            \"CynetSD64.exe\"\n        ],\n        \"url\": \"https://www.cynet.com/\"\n    },\n    \"金山网盾\": {\n        \"processes\": [\n            \"KSWebShield.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data安全软件客户端\": {\n        \"processes\": [\n            \"AVK.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"金山网镖\": {\n        \"processes\": [\n            \"kpfwtray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在扫1433\": {\n        \"processes\": [\n            \"1433.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在爆破\": {\n        \"processes\": [\n            \"DUB.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"发现S-U\": {\n        \"processes\": [\n            \"ServUDaemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士\": {\n        \"processes\": [\n            \"bddownloader.exe\",\n            \"baiduSafeTray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士-主进程\": {\n        \"processes\": [\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"已知杀软进程,名称暂未收录\": {\n        \"processes\": [\n            \"scan32.exe\",\n            \"mcscript.exe\",\n            \"cleanup.exe\",\n            \"cmdagent.exe\",\n            \"frminst.exe\",\n            \"mcscript_inuse.exe\",\n            \"_avp32.exe\",\n            \"_avpcc.exe\",\n            \"_avpm.exe\",\n            \"aAvgApi.exe\",\n            \"ackwin32.exe\",\n            \"advxdwin.exe\",\n            \"agentsvr.exe\",\n            \"agentw.exe\",\n            \"alertsvc.exe\",\n            \"alevir.exe\",\n            \"amon9x.exe\",\n            \"anti-trojan.exe\",\n            \"antivirus.exe\",\n            \"ants.exe\",\n            \"apimonitor.exe\",\n            \"aplica32.exe\",\n            \"arr.exe\",\n            \"atcon.exe\",\n            \"atguard.exe\",\n            \"atro55en.exe\",\n            \"atupdater.exe\",\n            \"atwatch.exe\",\n            \"au.exe\",\n            \"aupdate.exe\",\n            \"auto-protect.nav80try.exe\",\n            \"autodown.exe\",\n            \"autotrace.exe\",\n            \"autoupdate.exe\",\n            \"ave32.exe\",\n            \"avgcc32.exe\",\n            \"avgctrl.exe\",\n            \"avgserv9.exe\",\n            \"avkpop.exe\",\n            \"avkserv.exe\",\n            \"avkservice.exe\",\n            \"avltmain.exe\",\n            \"avnt.exe\",\n            \"avp32.exe\",\n            \"avpdos32.exe\",\n            \"avptc32.exe\",\n            \"avpupd.exe\",\n            \"avsched32.exe\",\n            \"avsynmgr.exe\",\n            \"avwin95.exe\",\n            \"avwinnt.exe\",\n            \"avwupd.exe\",\n            \"avwupd32.exe\",\n            \"avxmonitor9x.exe\",\n            \"avxmonitornt.exe\",\n            \"avxquar.exe\",\n            \"backweb.exe\",\n            \"bargains.exe\",\n            \"bd_professional.exe\",\n            \"beagle.exe\",\n            \"belt.exe\",\n            \"bidef.exe\",\n            \"bidserver.exe\",\n            \"bipcp.exe\",\n            \"bipcpevalsetup.exe\",\n            \"bisp.exe\",\n            \"blackice.exe\",\n            \"blss.exe\",\n            \"bootconf.exe\",\n            \"bootwarn.exe\",\n            \"borg2.exe\",\n            \"bpc.exe\",\n            \"brasil.exe\",\n            \"bs120.exe\",\n            \"bundle.exe\",\n            \"bvt.exe\",\n            \"cdp.exe\",\n            \"cfd.exe\",\n            \"cfiadmin.exe\",\n            \"cfiaudit.exe\",\n            \"cfinet.exe\",\n            \"cfinet32.exe\",\n            \"claw95.exe\",\n            \"claw95cf.exe\",\n            \"clean.exe\",\n            \"cleaner.exe\",\n            \"cleaner3.exe\",\n            \"cleanpc.exe\",\n            \"click.exe\",\n            \"cmesys.exe\",\n            \"cmon016.exe\",\n            \"connectionmonitor.exe\",\n            \"cpf9x206.exe\",\n            \"cpfnt206.exe\",\n            \"ctrl.exe\",\n            \"cwnb181.exe\",\n            \"cwntdwmo.exe\",\n            \"datemanager.exe\",\n            \"dcomx.exe\",\n            \"defalert.exe\",\n            \"defscangui.exe\",\n            \"defwatch.exe\",\n            \"deputy.exe\",\n            \"divx.exe\",\n            \"dllcache.exe\",\n            \"dllreg.exe\",\n            \"doors.exe\",\n            \"dpf.exe\",\n            \"dpfsetup.exe\",\n            \"dpps2.exe\",\n            \"drweb32.exe\",\n            \"drwebupw.exe\",\n            \"dssagent.exe\",\n            \"dvp95.exe\",\n            \"dvp95_0.exe\",\n            \"ecengine.exe\",\n            \"efpeadm.exe\",\n            \"emsw.exe\",\n            \"ent.exe\",\n            \"esafe.exe\",\n            \"escanhnt.exe\",\n            \"escanv95.exe\",\n            \"espwatch.exe\",\n            \"ethereal.exe\",\n            \"etrustcipe.exe\",\n            \"evpn.exe\",\n            \"exantivirus-cnet.exe\",\n            \"exe.avxw.exe\",\n            \"expert.exe\",\n            \"explore.exe\",\n            \"fast.exe\",\n            \"findviru.exe\",\n            \"firewall.exe\",\n            \"fp-win.exe\",\n            \"fp-win_trial.exe\",\n            \"fprot.exe\",\n            \"frw.exe\",\n            \"fsaa.exe\",\n            \"fsav.exe\",\n            \"fsav530stbyb.exe\",\n            \"fsav530wtbyb.exe\",\n            \"fsav95.exe\",\n            \"fsgk32.exe\",\n            \"fsm32.exe\",\n            \"gator.exe\",\n            \"gbmenu.exe\",\n            \"gbpoll.exe\",\n            \"generics.exe\",\n            \"gmt.exe\",\n            \"guard.exe\",\n            \"hacktracersetup.exe\",\n            \"hbinst.exe\",\n            \"hbsrv.exe\",\n            \"hotactio.exe\",\n            \"hotpatch.exe\",\n            \"htlog.exe\",\n            \"htpatch.exe\",\n            \"hwpe.exe\",\n            \"hxdl.exe\",\n            \"hxiul.exe\",\n            \"iamserv.exe\",\n            \"iamstats.exe\",\n            \"ibmasn.exe\",\n            \"ibmavsp.exe\",\n            \"icload95.exe\",\n            \"icloadnt.exe\",\n            \"icmon.exe\",\n            \"icsupp95.exe\",\n            \"icsuppnt.exe\",\n            \"idle.exe\",\n            \"iedll.exe\",\n            \"iedriver.exe\",\n            \"iface.exe\",\n            \"ifw2000.exe\",\n            \"inetlnfo.exe\",\n            \"infus.exe\",\n            \"infwin.exe\",\n            \"init.exe\",\n            \"intdel.exe\",\n            \"intren.exe\",\n            \"iomon98.exe\",\n            \"istsvc.exe\",\n            \"jammer.exe\",\n            \"jdbgmrg.exe\",\n            \"jedi.exe\",\n            \"kavlite40eng.exe\",\n            \"kavpers40eng.exe\",\n            \"kazza.exe\",\n            \"keenvalue.exe\",\n            \"kerio-pf-213-en-win.exe\",\n            \"kerio-wrl-421-en-win.exe\",\n            \"kerio-wrp-421-en-win.exe\",\n            \"kernel32.exe\",\n            \"killprocesssetup161.exe\",\n            \"launcher.exe\",\n            \"ldnetmon.exe\",\n            \"ldpro.exe\",\n            \"ldpromenu.exe\",\n            \"ldscan.exe\",\n            \"lnetinfo.exe\",\n            \"loader.exe\",\n            \"localnet.exe\",\n            \"lockdown.exe\",\n            \"lockdown2000.exe\",\n            \"lookout.exe\",\n            \"lordpe.exe\",\n            \"luau.exe\",\n            \"luinit.exe\",\n            \"luspt.exe\",\n            \"mapisvc32.exe\",\n            \"mcagent.exe\",\n            \"mctool.exe\",\n            \"mcupdate.exe\",\n            \"mfin32.exe\",\n            \"mfw2en.exe\",\n            \"mfweng3.02d30.exe\",\n            \"mgavrtcl.exe\",\n            \"mgavrte.exe\",\n            \"mgui.exe\",\n            \"minilog.exe\",\n            \"mmod.exe\",\n            \"monitor.exe\",\n            \"moolive.exe\",\n            \"mostat.exe\",\n            \"mrflux.exe\",\n            \"msapp.exe\",\n            \"msbb.exe\",\n            \"msblast.exe\",\n            \"mscache.exe\",\n            \"msccn32.exe\",\n            \"mscman.exe\",\n            \"msconfig.exe\",\n            \"msdm.exe\",\n            \"msdos.exe\",\n            \"msiexec16.exe\",\n            \"msinfo32.exe\",\n            \"mslaugh.exe\",\n            \"msmgt.exe\",\n            \"msmsgri32.exe\",\n            \"mssmmc32.exe\",\n            \"mssys.exe\",\n            \"msvxd.exe\",\n            \"mu0311ad.exe\",\n            \"mwatch.exe\",\n            \"n32scanw.exe\",\n            \"navap.navapsvc.exe\",\n            \"navdx.exe\",\n            \"navlu32.exe\",\n            \"navnt.exe\",\n            \"navstub.exe\",\n            \"navw32.exe\",\n            \"navwnt.exe\",\n            \"nc2000.exe\",\n            \"ncinst4.exe\",\n            \"ndd32.exe\",\n            \"neomonitor.exe\",\n            \"neowatchlog.exe\",\n            \"netarmor.exe\",\n            \"netd32.exe\",\n            \"netinfo.exe\",\n            \"netmon.exe\",\n            \"netscanpro.exe\",\n            \"netspyhunter-1.2.exe\",\n            \"netstat.exe\",\n            \"netutils.exe\",\n            \"nisserv.exe\",\n            \"nod32.exe\",\n            \"normist.exe\",\n            \"norton_internet_secu_3.0_407.exe\",\n            \"notstart.exe\",\n            \"npf40_tw_98_nt_me_2k.exe\",\n            \"npfmessenger.exe\",\n            \"npscheck.exe\",\n            \"npssvc.exe\",\n            \"nsched32.exe\",\n            \"nssys32.exe\",\n            \"nstask32.exe\",\n            \"nsupdate.exe\",\n            \"nt.exe\",\n            \"ntvdm.exe\",\n            \"ntxconfig.exe\",\n            \"nui.exe\",\n            \"nupgrade.exe\",\n            \"nvarch16.exe\",\n            \"nvc95.exe\",\n            \"nvsvc32.exe\",\n            \"nwinst4.exe\",\n            \"nwservice.exe\",\n            \"nwtool16.exe\",\n            \"ollydbg.exe\",\n            \"onsrvr.exe\",\n            \"optimize.exe\",\n            \"ostronet.exe\",\n            \"otfix.exe\",\n            \"outpostinstall.exe\",\n            \"outpostproinstall.exe\",\n            \"padmin.exe\",\n            \"panixk.exe\",\n            \"patch.exe\",\n            \"pavcl.exe\",\n            \"pavw.exe\",\n            \"pccwin98.exe\",\n            \"pcfwallicon.exe\",\n            \"pcip10117_0.exe\",\n            \"pcscan.exe\",\n            \"pdsetup.exe\",\n            \"periscope.exe\",\n            \"perswf.exe\",\n            \"pf2.exe\",\n            \"pfwadmin.exe\",\n            \"pgmonitr.exe\",\n            \"pingscan.exe\",\n            \"platin.exe\",\n            \"poproxy.exe\",\n            \"popscan.exe\",\n            \"portdetective.exe\",\n            \"portmonitor.exe\",\n            \"powerscan.exe\",\n            \"ppinupdt.exe\",\n            \"pptbc.exe\",\n            \"ppvstop.exe\",\n            \"prizesurfer.exe\",\n            \"prmt.exe\",\n            \"prmvr.exe\",\n            \"procdump.exe\",\n            \"processmonitor.exe\",\n            \"procexplorerv1.0.exe\",\n            \"programauditor.exe\",\n            \"proport.exe\",\n            \"protectx.exe\",\n            \"pspf.exe\",\n            \"purge.exe\",\n            \"qconsole.exe\",\n            \"qserver.exe\",\n            \"rav7.exe\",\n            \"rav7win.exe\",\n            \"rav8win32eng.exe\",\n            \"ray.exe\",\n            \"rb32.exe\",\n            \"rcsync.exe\",\n            \"realmon.exe\",\n            \"reged.exe\",\n            \"regedit.exe\",\n            \"regedt32.exe\",\n            \"rescue.exe\",\n            \"rescue32.exe\",\n            \"rrguard.exe\",\n            \"rshell.exe\",\n            \"rtvscn95.exe\",\n            \"rulaunch.exe\",\n            \"run32dll.exe\",\n            \"rundll.exe\",\n            \"rundll16.exe\",\n            \"ruxdll32.exe\",\n            \"safeweb.exe\",\n            \"sahagent.exe\",\n            \"save.exe\",\n            \"savenow.exe\",\n            \"sc.exe\",\n            \"scam32.exe\",\n            \"scan95.exe\",\n            \"scanpm.exe\",\n            \"scrscan.exe\",\n            \"serv95.exe\",\n            \"setup_flowprotector_us.exe\",\n            \"setupvameeval.exe\",\n            \"sfc.exe\",\n            \"sgssfw32.exe\",\n            \"sh.exe\",\n            \"shellspyinstall.exe\",\n            \"shn.exe\",\n            \"showbehind.exe\",\n            \"sms.exe\",\n            \"smss32.exe\",\n            \"soap.exe\",\n            \"sofi.exe\",\n            \"sperm.exe\",\n            \"spf.exe\",\n            \"spoler.exe\",\n            \"spoolcv.exe\",\n            \"spoolsv32.exe\",\n            \"spyxx.exe\",\n            \"srexe.exe\",\n            \"srng.exe\",\n            \"ss3edit.exe\",\n            \"ssg_4104.exe\",\n            \"ssgrate.exe\",\n            \"st2.exe\",\n            \"start.exe\",\n            \"stcloader.exe\",\n            \"supftrl.exe\",\n            \"support.exe\",\n            \"supporter5.exe\",\n            \"svchostc.exe\",\n            \"svchosts.exe\",\n            \"sweep95.exe\",\n            \"sweepnet.sweepsrv.sys.swnetsup.exe\",\n            \"symtray.exe\",\n            \"sysedit.exe\",\n            \"sysupd.exe\",\n            \"taskmg.exe\",\n            \"taskmo.exe\",\n            \"taumon.exe\",\n            \"tbscan.exe\",\n            \"tc.exe\",\n            \"tca.exe\",\n            \"tcm.exe\",\n            \"tds-3.exe\",\n            \"tds2-98.exe\",\n            \"tds2-nt.exe\",\n            \"teekids.exe\",\n            \"tfak.exe\",\n            \"tfak5.exe\",\n            \"tgbob.exe\",\n            \"titanin.exe\",\n            \"titaninxp.exe\",\n            \"tracert.exe\",\n            \"trickler.exe\",\n            \"trjsetup.exe\",\n            \"trojantrap3.exe\",\n            \"tsadbot.exe\",\n            \"tvmd.exe\",\n            \"tvtmd.exe\",\n            \"undoboot.exe\",\n            \"updat.exe\",\n            \"update.exe\",\n            \"upgrad.exe\",\n            \"utpost.exe\",\n            \"vbcons.exe\",\n            \"vbust.exe\",\n            \"vbwin9x.exe\",\n            \"vbwinntw.exe\",\n            \"vcsetup.exe\",\n            \"vet32.exe\",\n            \"vet95.exe\",\n            \"vettray.exe\",\n            \"vfsetup.exe\",\n            \"vir-help.exe\",\n            \"virusmdpersonalfirewall.exe\",\n            \"vnlan300.exe\",\n            \"vnpc3000.exe\",\n            \"vpc42.exe\",\n            \"vpfw30s.exe\",\n            \"vscan40.exe\",\n            \"vscenu6.02d30.exe\",\n            \"vsched.exe\",\n            \"vsecomr.exe\",\n            \"vsisetup.exe\",\n            \"vsmain.exe\",\n            \"vswin9xe.exe\",\n            \"vswinntse.exe\",\n            \"vswinperse.exe\",\n            \"w32dsm89.exe\",\n            \"w9x.exe\",\n            \"watchdog.exe\",\n            \"webdav.exe\",\n            \"wfindv32.exe\",\n            \"whoswatchingme.exe\",\n            \"wimmun32.exe\",\n            \"win-bugsfix.exe\",\n            \"win32.exe\",\n            \"win32us.exe\",\n            \"winactive.exe\",\n            \"window.exe\",\n            \"windows.exe\",\n            \"wininetd.exe\",\n            \"wininitx.exe\",\n            \"winlogin.exe\",\n            \"winmain.exe\",\n            \"winnet.exe\",\n            \"winppr32.exe\",\n            \"winrecon.exe\",\n            \"winservn.exe\",\n            \"winssk32.exe\",\n            \"winstart.exe\",\n            \"winstart001.exe\",\n            \"wintsk32.exe\",\n            \"winupdate.exe\",\n            \"wkufind.exe\",\n            \"wnad.exe\",\n            \"wnt.exe\",\n            \"wradmin.exe\",\n            \"wsbgate.exe\",\n            \"wupdater.exe\",\n            \"wupdt.exe\",\n            \"wyvernworksfirewall.exe\",\n            \"xpf202en.exe\",\n            \"zapsetup3001.exe\",\n            \"zatutor.exe\",\n            \"zonalm2601.exe\",\n            \"A2CMD.exe\",\n            \"ADVCHK.exe\",\n            \"AGB.exe\",\n            \"AKRNL.exe\",\n            \"AHPROCMONSERVER.exe\",\n            \"AIRDEFENSE.exe\",\n            \"ALERTSVC.exe\",\n            \"AVIRA.exe\",\n            \"AMON.exe\",\n            \"TROJAN.exe\",\n            \"AVZ.exe\",\n            \"ANTIVIR.exe\",\n            \"ARMOR2NET.exe\",\n            \"ASH.exeexe.exe\",\n            \"ASHENHCD.exe\",\n            \"ASHMAISV.exe\",\n            \"ASHPOPWZ.exe\",\n            \"ASHSERV.exe\",\n            \"ASHSIMPL.exe\",\n            \"ASHSKPCK.exe\",\n            \"ASHWEBSV.exe\",\n            \"ASWUPDSV.exe\",\n            \"ASWSCAN.exe\",\n            \"AVCIMAN.exe\",\n            \"AVENGINE.exe\",\n            \"AVESVC.exe\",\n            \"AVEVAL.exe\",\n            \"AVEVL32.exe\",\n            \"AVGAM.exe\",\n            \"AVGCC.exe\",\n            \"AVGCHSVX.exe\",\n            \"AVGCSRVX.exe\",\n            \"AVGNSX.exe\",\n            \"AVGCC32.exe\",\n            \"AVGCTRL.exe\",\n            \"AVGFWSRV.exe\",\n            \"AVGNTMGR.exe\",\n            \"AVGTRAY.exe\",\n            \"AVGUPSVC.exe\",\n            \"AVINITNT.exe\",\n            \"AVKSERV.exe\",\n            \"AVKSERVICE.exe\",\n            \"AVP32.exe\",\n            \"AVSERVER.exe\",\n            \"AVSCHED32.exe\",\n            \"AVSYNMGR.exe\",\n            \"AVWUPD32.exe\",\n            \"AVXMONITOR.exe\",\n            \"AVXQUAR.exe\",\n            \"BDSWITCH.exe\",\n            \"BLACKICE.exe\",\n            \"CAFIX.exe\",\n            \"CFP.exe\",\n            \"CFPCONFIG.exe\",\n            \"CFIAUDIT.exe\",\n            \"CLAMWIN.exe\",\n            \"CUREIT.exe\",\n            \"DEFWATCH.exe\",\n            \"DRVIRUS.exe\",\n            \"DRWADINS.exe\",\n            \"DRWEB.exe\",\n            \"DEFENDERDAEMON.exe\",\n            \"DWEBLLIO.exe\",\n            \"DWEBIO.exe\",\n            \"ESCANH95.exe\",\n            \"ESCANHNT.exe\",\n            \"EWIDOCTRL.exe\",\n            \"EZANTIVIRUSREGISTRATIONCHECK.exe\",\n            \"FILEMON.exe\",\n            \"FIREWALL.exe\",\n            \"FORTISCAN.exe\",\n            \"FPWIN.exe\",\n            \"FSBWSYS.exe\",\n            \"F-SCHED.exe\",\n            \"FSDFWD.exe\",\n            \"FSGK32.exe\",\n            \"FSGK32ST.exe\",\n            \"FSGUIEXE.exe\",\n            \"FSPEX.exe\",\n            \"GCASDTSERV.exe\",\n            \"GCASSERV.exe\",\n            \"GIANTANTISPYWARE.exe\",\n            \"GUARDGUI.exe\",\n            \"GUARDNT.exe\",\n            \"HREGMON.exe\",\n            \"HRRES.exe\",\n            \"HSOCKPE.exe\",\n            \"HUPDATE.exe\",\n            \"IAMSERV.exe\",\n            \"ICLOAD95.exe\",\n            \"ICLOADNT.exe\",\n            \"ICMON.exe\",\n            \"ICSSUPPNT.exe\",\n            \"ICSUPP95.exe\",\n            \"ICSUPPNT.exe\",\n            \"INETUPD.exe\",\n            \"INOCIT.exe\",\n            \"INORPC.exe\",\n            \"INORT.exe\",\n            \"INOTASK.exe\",\n            \"INOUPTNG.exe\",\n            \"IOMON98.exe\",\n            \"ISAFE.exe\",\n            \"ISATRAY.exe\",\n            \"KAV.exe\",\n            \"KAVMM.exe\",\n            \"KAVPFW.exe\",\n            \"KAVSTART.exe\",\n            \"KAVSVC.exe\",\n            \"KAVSVCUI.exe\",\n            \"KMAILMON.exe\",\n            \"MAMUTU.exe\",\n            \"MCAGENT.exe\",\n            \"MCREGWIZ.exe\",\n            \"MCUPDATE.exe\",\n            \"MINILOG.exe\",\n            \"MYAGTSVC.exe\",\n            \"MYAGTTRY.exe\",\n            \"NAVLU32.exe\",\n            \"NAVW32.exe\",\n            \"NEOWATCHLOG.exe\",\n            \"NEOWATCHTRAY.exe\",\n            \"NISSERV.exe\",\n            \"NOD32.exe\",\n            \"NORMIST.exe\",\n            \"NOTSTART.exe\",\n            \"NPAVTRAY.exe\",\n            \"NPFMSG.exe\",\n            \"NSCHED32.exe\",\n            \"NSMDTR.exe\",\n            \"NSSSERV.exe\",\n            \"NSSTRAY.exe\",\n            \"NTOS.exe\",\n            \"NTXCONFIG.exe\",\n            \"NUPGRADE.exe\",\n            \"NVCOD.exe\",\n            \"NVCTE.exe\",\n            \"NVCUT.exe\",\n            \"NWSERVICE.exe\",\n            \"OFCPFWSVC.exe\",\n            \"OPSSVC.exe\",\n            \"OP_MON.exe\",\n            \"PAVFIRES.exe\",\n            \"PAVFNSVR.exe\",\n            \"PAVKRE.exe\",\n            \"PAVPROT.exe\",\n            \"PAVPRSRV.exe\",\n            \"PAVSRV51.exe\",\n            \"PAVSS.exe\",\n            \"PCCGUIDE.exe\",\n            \"PCCIOMON.exe\",\n            \"PCCPFW.exe\",\n            \"PCCTLCOM.exe\",\n            \"PERTSK.exe\",\n            \"PERVAC.exe\",\n            \"PESTPATROL.exe\",\n            \"PNMSRV.exe\",\n            \"PREVSRV.exe\",\n            \"PREVX.exe\",\n            \"PSIMSVC.exe\",\n            \"QHONLINE.exe\",\n            \"QHONSVC.exe\",\n            \"QHWSCSVC.exe\",\n            \"QHSET.exe\",\n            \"RTVSCN95.exe\",\n            \"SALITY.exe\",\n            \"SAVADMINSERVICE.exe\",\n            \"SAVSCAN.exe\",\n            \"SCANNINGPROCESS.exe\",\n            \"SDRA64.exe\",\n            \"SDHELP.exe\",\n            \"SITECLI.exe\",\n            \"SPBBCSVC.exe\",\n            \"SPIDERCPL.exe\",\n            \"SPIDERML.exe\",\n            \"SPIDERUI.exe\",\n            \"SPYBOTSD.exe\",\n            \"SPYXX.exe\",\n            \"SS3EDIT.exe\",\n            \"STOPSIGNAV.exe\",\n            \"SWAGENT.exe\",\n            \"SWDOCTOR.exe\",\n            \"SWNETSUP.exe\",\n            \"SYMLCSVC.exe\",\n            \"SYMSPORT.exe\",\n            \"SYMWSC.exe\",\n            \"SYNMGR.exe\",\n            \"TAUMON.exe\",\n            \"TMNTSRV.exe\",\n            \"TMPROXY.exe\",\n            \"TNBUTIL.exe\",\n            \"VBA32ECM.exe\",\n            \"VBA32IFS.exe\",\n            \"VBA32LDR.exe\",\n            \"VBA32PP3.exe\",\n            \"VBSNTW.exe\",\n            \"VCRMON.exe\",\n            \"VRFWSVC.exe\",\n            \"VRRW32.exe\",\n            \"VSECOMR.exe\",\n            \"WATCHDOG.exe\",\n            \"WINSSNOTIFY.exe\",\n            \"XCOMMSVR.exe\",\n            \"ZLCLIENT.exe\",\n            \"navap.exe\",\n            \"sahagent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data文件系统实时监控\": {\n        \"processes\": [\n            \"avkwctl9.exe\",\n            \"AVKWCTL.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Anti-Virus\": {\n        \"processes\": [\n            \"SAVMAIN.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360保险箱\": {\n        \"processes\": [\n            \"safeboxTray.exe\",\n            \"360safebox.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data扫描器\": {\n        \"processes\": [\n            \"GDScan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data杀毒代理\": {\n        \"processes\": [\n            \"AVKProxy.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data备份服务\": {\n        \"processes\": [\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"亚信安全服务器深度安全防护系统\": {\n        \"processes\": [\n            \"Notifier.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云盾\": {\n        \"processes\": [\n            \"AliYunDun.exe\",\n            \"AliYunDunUpdate.exe\",\n            \"aliyun_assist_service.exe\",\n            \"/usr/local/aegis/aegis_client/\"\n        ],\n        \"url\": \"\"\n    },\n    \"腾讯云安全\": {\n        \"processes\": [\n            \"BaradAgent.exe\",\n            \"sgagent.exe\",\n            \"YDService.exe\",\n            \"YDLive.exe\",\n            \"YDEdr.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360主机卫士Web\": {\n        \"processes\": [\n            \"360WebSafe.exe\",\n            \"QHSrv.exe\",\n            \"QHWebshellGuard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"网防G01\": {\n        \"processes\": [\n            \"gov_defence_service.exe\",\n            \"gov_defence_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"云锁客户端\": {\n        \"processes\": [\n            \"PC.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Symantec Shared诺顿邮件防火墙软件\": {\n        \"processes\": [\n            \"SNDSrvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"U盘杀毒专家\": {\n        \"processes\": [\n            \"USBKiller.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天擎EDRAgent\": {\n        \"processes\": [\n            \"360EntClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360(奇安信)天擎\": {\n        \"processes\": [\n            \"360EntMisc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云-云盾\": {\n        \"processes\": [\n            \"alisecguard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos AutoUpdate Service\": {\n        \"processes\": [\n            \"ALsvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云监控\": {\n        \"processes\": [\n            \"CmsGoAgent.windows-amd64.\"\n        ],\n        \"url\": \"\"\n    },\n    \"深信服EDRAgent\": {\n        \"processes\": [\n            \"edr_agent.exe\",\n            \"edr_monitor.exe\",\n            \"edr_sec_plan.exe\"\n        ],\n        \"url\": \"https://edr.sangfor.com.cn\"\n    },\n    \"戎码翼龙 NG-EDR\": {\n        \"processes\": [\n            \"rm_service.exe\",\n            \"rm_live.exe\",\n            \"rm_tray.exe\",\n            \"rm_hips.exe\"\n        ],\n        \"url\": \"https://www.rongma.com\"\n    },\n    \"启明星辰天珣EDRAgent\": {\n        \"processes\": [\n            \"ESAV.exe\",\n            \"ESCCControl.exe\",\n            \"ESCC.exe\",\n            \"ESCCIndex.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"蓝鲸Agent\": {\n        \"processes\": [\n            \"gse_win_agent.exe\",\n            \"gse_win_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"联想电脑管家\": {\n        \"processes\": [\n            \"LAVService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Agent\": {\n        \"processes\": [\n            \"McsAgent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Client\": {\n        \"processes\": [\n            \"McsClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360TotalSecurity(360国际版)\": {\n        \"processes\": [\n            \"QHSafeMain.exe\",\n            \"QHSafeTray.exe\",\n            \"QHWatchdog.exe\",\n            \"QHActiveDefense.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Device Control Service\": {\n        \"processes\": [\n            \"sdcservice.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Endpoint Defense Service\": {\n        \"processes\": [\n            \"SEDService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Windows Defender SmartScreen\": {\n        \"processes\": [\n            \"smartscreen.exe\"\n        ],\n        \"url\": \"https://learn.microsoft.com/zh-cn/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/\"\n    },\n    \"Sophos Clean Service\": {\n        \"processes\": [\n            \"SophosCleanM64.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos FIM\": {\n        \"processes\": [\n            \"SophosFIMService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos System Protection Service\": {\n        \"processes\": [\n            \"SSPService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Web Control Service\": {\n        \"processes\": [\n            \"swc_service.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天眼云镜\": {\n        \"processes\": [\n            \"TitanAgent.exe\",\n            \"TitanMonitor.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天融信终端防御\": {\n        \"processes\": [\n            \"TopsecMain.exe\",\n            \"TopsecTray.exe\"\n        ],\n     ","isInternal":false,"tokens":13624,"sizeBytes":50612},{"name":"SKILL.md","path":"SKILL.md","rawUrl":"https://raw.githubusercontent.com/shadow1ng/fscan/HEAD/SKILL.md","title":"fscan-agent","category":"anthropic-skill","format":"markdown","content":"---\nname: fscan-agent\ndescription: 使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。\nargument-hint: <目标IP/网段> [附加参数]\nallowed-tools: Bash, Read, Agent\n---\n\n# Fscan AI Agent Skill\n\n## 工具概述\n\nFscan 是一款内网综合扫描工具，功能包括：\n- 主机存活探测（ICMP / TCP）\n- 端口扫描与服务识别\n- 漏洞检测（MS17-010、Redis 未授权等）\n- 弱口令爆破（SSH、SMB、MySQL、MSSQL、FTP、RDP 等）\n- Web 指纹识别与 POC 扫描\n- NetBIOS / SMB 信息收集\n- 本地信息收集（杀软检测、系统信息等）\n\n二进制路径：当前项目编译产物 `fscan_cli`，或系统 PATH 中的 `fscan`。\n\n## 调用格式\n\n```bash\n# AI agent 标准用法：NDJSON 输出，无人类日志干扰\nfscan -h <目标> -silent [其他参数]\n\n# 解析输出\nfscan -h 192.168.1.0/24 -silent | jq 'select(.type==\"VULN\")'\n```\n\n## 核心参数\n\n### 目标指定\n\n| 参数 | 说明 | 示例 |\n|------|------|------|\n| `-h` | 目标主机（IP / CIDR / 范围） | `-h 192.168.1.0/24` `-h 10.0.0.1-10.0.0.100` |\n| `-hf` | 从文件读取目标 | `-hf targets.txt` |\n| `-p` | 指定端口（逗号/范围） | `-p 22,80,443,445,3306` `-p 1-1000` |\n| `-ep` | 排除端口 | `-ep 25,110` |\n| `-eh` | 排除主机 | `-eh 192.168.1.1` |\n| `-u` | 指定 URL（Web 扫描） | `-u https://example.com` |\n| `-uf` | URL 文件 | `-uf urls.txt` |\n\n### 扫描控制\n\n| 参数 | 说明 | 默认值 |\n|------|------|--------|\n| `-m` | 扫描模式 | `all` |\n| `-t` | 端口扫描线程数 | `600` |\n| `-mt` | 模块线程数 | `20` |\n| `-time` | 连接超时（秒） | `3` |\n| `-gt` | 全局超时（秒，0 表示不限制） | `0` |\n| `-np` | 跳过存活检测 | `false` |\n| `-ntp` | 禁用 TCP 补充探测 | `false` |\n| `-ao` | 仅存活检测 | `false` |\n| `-nobr` | 禁用暴力破解 | `false` |\n| `-full` | 全量 POC 扫描 | `false` |\n| `-max-retries` | 最大重试次数 | `1` |\n\n### 认证\n\n| 参数 | 说明 |\n|------|------|\n| `-user` | 用户名 |\n| `-pwd` | 密码 |\n| `-usera` | 追加用户名 |\n| `-pwda` | 追加密码，支持逗号或空格分隔多个值 |\n| `-userf` | 用户名字典文件 |\n| `-pwdf` | 密码字典文件 |\n| `-domain` | 域名（SMB/WMI） |\n| `-sshkey` | SSH 私钥文件 |\n| `-hash` / `-hashf` | NTLM Hash / Hash 文件 |\n\n### 代理\n\n| 参数 | 说明 |\n|------|------|\n| `-socks5` | SOCKS5 代理 (`127.0.0.1:1080`) |\n| `-proxy` | HTTP 代理 (`http://127.0.0.1:8080`) |\n| `-iface` | 指定本地网卡 IP（VPN 场景） |\n\n### 输出\n\n| 参数 | 说明 |\n|------|------|\n| `-silent` | 静默模式：stdout 仅输出 NDJSON |\n| `-o` | 输出文件路径（默认 `result.txt`） |\n| `-f` | 输出格式：`txt` / `json` / `csv` |\n| `-no` | 禁用文件保存 |\n| `-debug` | 调试模式：日志写入 `fscan_debug.log` |\n| `-log` | 日志级别（`debug` / `info` / `base` / `error`） |\n\n### 扫描模式 `-m` 的取值\n\n| 值 | 说明 |\n|------|------|\n| `all` | 全部扫描（默认） |\n| `icmp` | 仅 ICMP 存活检测 |\n| 插件名 | 仅运行指定插件（如 `ssh`、`smb`、`ms17010`、`webtitle`） |\n\n## 服务插件列表\n\n| 插件 | 默认端口 | 功能 |\n|------|----------|------|\n| `ftp` | 21 | FTP 弱口令 |\n| `ssh` | 22 | SSH 弱口令 |\n| `telnet` | 23 | Telnet 弱口令 |\n| `smtp` | 25 | SMTP 弱口令 |\n| `findnet` | 135 | RPC 网络信息发现（NetInfo） |\n| `netbios` | 139 | NetBIOS 信息收集 |\n| `smb` | 445 | SMB 弱口令 |\n| `ms17010` | 445 | MS17-010 永恒之蓝检测 |\n| `ldap` | 389 | LDAP 弱口令 |\n| `mssql` | 1433 | MSSQL 弱口令 |\n| `oracle` | 1521 | Oracle 弱口令 |\n| `mysql` | 3306 | MySQL 弱口令 |\n| `rdp` | 3389 | RDP 弱口令 + 系统信息 |\n| `postgresql` | 5432 | PostgreSQL 弱口令 |\n| `vnc` | 5900 | VNC 弱口令 |\n| `redis` | 6379 | Redis 未授权 + 弱口令 |\n| `elasticsearch` | 9200 | ES 未授权 |\n| `mongodb` | 27017 | MongoDB 未授权 + 弱口令 |\n| `memcached` | 11211 | Memcached 未授权 |\n| `kafka` | 9092 | Kafka 未授权 |\n| `activemq` | 61616 | ActiveMQ 弱口令 |\n| `rabbitmq` | 5672 | RabbitMQ 弱口令 |\n| `cassandra` | 9042 | Cassandra 弱口令 |\n| `neo4j` | 7687 | Neo4j 弱口令 |\n| `rsync` | 873 | Rsync 未授权 |\n| `webtitle` | 80/443 | Web 标题 + 指纹识别 |\n| `webpoc` | 80/443 | Web 漏洞 POC |\n\n## 本地插件（`-local`）\n\n```bash\nfscan -local avdetect    # 杀软检测\nfscan -local systeminfo  # 系统信息收集\nfscan -local envinfo     # 环境变量信息\nfscan -local dcinfo      # 域控信息\nfscan -local fileinfo    # 敏感文件搜索\n```\n\n## NDJSON 输出 Schema（`-silent` 模式）\n\n每行一个 JSON 对象，所有字段定义：\n\n| 字段 | 类型 | 出现条件 | 说明 |\n|------|------|----------|------|\n| `type` | string | 必有 | `HOST` / `PORT` / `SERVICE` / `VULN` |\n| `target` | string | 必有 | 原始目标 `host` 或 `host:port` |\n| `status` | string | 必有 | 状态描述 |\n| `host` | string | 必有 | IP 地址 |\n| `port` | int | PORT/SERVICE/VULN | 端口号 |\n| `service` | string | SERVICE/VULN | 服务名（ssh, smb, http 等） |\n| `protocol` | string | HOST/SERVICE | 协议（ICMP, TCP, http, https） |\n| `banner` | string | SERVICE | 服务 Banner |\n| `title` | string | SERVICE (web) | 网页标题 |\n| `url` | string | SERVICE (web) | 完整 URL |\n| `vulnerability` | string | VULN | 漏洞名称 |\n| `username` | string | VULN (弱口令) | 用户名 |\n| `password` | string | VULN (弱口令) | 密码 |\n| `plugin` | string | SERVICE/VULN | 产生结果的插件名 |\n| `version` | string | SERVICE | 服务版本号 |\n| `os` | string | SERVICE | 操作系统信息 |\n\n### 输出示例\n\n```jsonl\n{\"type\":\"HOST\",\"target\":\"192.168.1.5\",\"status\":\"alive\",\"host\":\"192.168.1.5\",\"protocol\":\"ICMP\"}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":22}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":445}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:22\",\"status\":\"identified\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"banner\":\"SSH-2.0-OpenSSH_8.9p1\",\"version\":\"8.9p1\",\"plugin\":\"portscan\"}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:80\",\"status\":\"web\",\"host\":\"192.168.1.5\",\"port\":80,\"service\":\"http\",\"protocol\":\"http\",\"url\":\"http://192.168.1.5:80\",\"title\":\"Welcome\",\"plugin\":\"webtitle\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:445\",\"status\":\"MS17-010 (Windows Server 2012 R2 Standard 9600)\",\"host\":\"192.168.1.5\",\"port\":445,\"vulnerability\":\"MS17-010\",\"service\":\"smb\",\"plugin\":\"ms17010\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:22\",\"status\":\"weak_credential: root:123456\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"username\":\"root\",\"password\":\"123456\",\"plugin\":\"ssh\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:6379\",\"status\":\"Redis unauthorized\",\"host\":\"192.168.1.5\",\"port\":6379,\"vulnerability\":\"Redis unauthorized access\",\"service\":\"redis\",\"plugin\":\"redis\"}\n```\n\n### 结果产出顺序\n\n1. `HOST` — 存活探测阶段\n2. `PORT` — 端口扫描阶段（与 SERVICE 可能交错）\n3. `SERVICE` — 服务识别阶段\n4. `VULN` — 漏洞/弱口令检测阶段\n\n同一 `host:port` 可产生多条结果（PORT + SERVICE + VULN）。\n\n## 常用场景参数组合\n\n### 全网段快速扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent\n```\n\n### 跳过存活检测直接扫端口（目标明确时）\n\n```bash\nfscan -h 192.168.1.0/24 -silent -np\n```\n\n### 指定端口精确扫描\n\n```bash\nfscan -h 10.0.0.0/24 -silent -p 22,80,443,445,3389,3306,6379\n```\n\n### 仅存活探测\n\n```bash\nfscan -h 172.16.0.0/16 -silent -m icmp\n```\n\n### 低速隐蔽扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent -t 30 -time 5\n```\n\n### 通过 SOCKS5 代理扫描内网\n\n```bash\nfscan -h 10.0.0.0/24 -silent -socks5 127.0.0.1:1080\n```\n\n### 仅做弱口令检测\n\n```bash\nfscan -h 192.168.1.10 -silent -m ssh -user root -pwdf /path/to/passwords.txt\n```\n\n### Web 目标扫描\n\n```bash\nfscan -u https://target.com -silent -full\n```\n\n### 多目标文件批量扫描\n\n```bash\nfscan -hf targets.txt -silent -o results.json -f json\n```\n\n### 带调试日志的排障扫描\n\n```bash\n# NDJSON 到 stdout，debug 日志到文件，互不干扰\nfscan -h 192.168.1.0/24 -silent -debug\n# 事后查看：cat fscan_debug.log\n```\n\n## AI Agent 结果处理\n\n### Python 管道消费\n\n```python\nimport json, subprocess\n\nproc = subprocess.Popen(\n    [\"fscan\", \"-h\", \"192.168.1.0/24\", \"-silent\"],\n    stdout=subprocess.PIPE, text=True\n)\n\nhosts, services, vulns = [], [], []\nfor line in proc.stdout:\n    r = json.loads(line)\n    if r[\"type\"] == \"HOST\":\n        hosts.append(r[\"host\"])\n    elif r[\"type\"] == \"SERVICE\":\n        services.append(r)\n    elif r[\"type\"] == \"VULN\":\n        vulns.append(r)\n\nproc.wait()\n```\n\n### jq 过滤\n\n```bash\n# 提取所有弱口令\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.username != null) | \"\\(.host):\\(.port) \\(.service) \\(.username):\\(.password)\"'\n\n# 提取所有漏洞\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"VULN\") | \"\\(.host):\\(.port) \\(.vulnerability)\"'\n\n# 提取 Web 服务\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.url != null) | \"\\(.url) \\(.title)\"'\n\n# 统计开放端口\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"PORT\") | .port' | sort -n | uniq -c | sort -rn\n```\n\n## 注意事项\n\n- `-silent` 抑制所有人类可读日志，stdout 仅输出 NDJSON\n- 空字段不出现在 JSON 中（`omitempty`）\n- 进程退出码 `0` 正常完成，非 `0` 表示参数错误或初始化失败\n- `-silent` 和 `-debug` 可同时使用，互不干扰\n- SOCKS5 代理下 fscan 信任协议层连接结果，不做额外深度验证\n- 扫描大网段时线程数会自动调整，资源耗尽时自适应降级\n- 默认超时 3 秒，防火墙 drop 的端口会静默超时，不计入失败率\n","frontmatter":{"name":"fscan-agent","description":"使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。","argument-hint":"<目标IP/网段> [附加参数]","allowed-tools":"Bash, Read, Agent","allowedTools":["Bash,","Read,","Agent"]},"allowedTools":["Bash,","Read,","Agent"],"isInternal":false,"tokens":3886,"sizeBytes":9904},{"name":"README.md","path":"plugins/README.md","rawUrl":"https://raw.githubusercontent.com/shadow1ng/fscan/HEAD/plugins/README.md","title":"plugins Documentation","category":"plugin-manifest","format":"markdown","content":"# FScan 插件开发规范\n\n## 概述\n\nFScan 采用简化的单文件插件架构，每个插件一个 `.go` 文件，消除了过度设计的多文件结构。\n\n\n1. **简洁至上**：消除所有不必要的抽象层\n2. **直击本质**：专注于解决实际问题，不为架构而架构  \n3. **向后兼容**：不破坏用户接口和现有功能\n4. **消除特殊情况**：统一处理逻辑，减少 if/else 分支\n\n## 插件架构\n\n### 核心接口\n\n```go\n// Plugin 插件接口 - 只保留必要的方法\ntype Plugin interface {\n    GetName() string                                        // 插件名称\n    GetPorts() []int                                       // 支持的端口\n    Scan(ctx context.Context, info *common.HostInfo) *ScanResult  // 扫描功能\n}\n\n// 可选接口：如果插件支持利用功能\ntype Exploiter interface {\n    Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult\n}\n```\n\n### 数据结构\n\n```go\n// ScanResult 扫描结果 - 删除所有冗余字段\ntype ScanResult struct {\n    Success  bool   // 扫描是否成功\n    Service  string // 服务类型\n    Username string // 发现的用户名（弱密码）\n    Password string // 发现的密码（弱密码）  \n    Banner   string // 服务版本信息\n    Error    error  // 错误信息（如果失败）\n}\n\n// ExploitResult 利用结果（仅有利用功能的插件需要）\ntype ExploitResult struct {\n    Success bool   // 利用是否成功\n    Output  string // 命令执行输出\n    Error   error  // 错误信息\n}\n\n// Credential 凭据结构\ntype Credential struct {\n    Username string\n    Password string\n    KeyData  []byte // SSH私钥等\n}\n```\n\n## 插件开发模板\n\n### 1. 纯扫描插件（如MySQL）\n\n```go\npackage plugins\n\nimport (\n    \"context\"\n    \"fmt\"\n    // 其他必要导入\n)\n\n// PluginName服务扫描插件\ntype PluginNamePlugin struct {\n    name  string\n    ports []int\n}\n\n// 构造函数\nfunc NewPluginNamePlugin() *PluginNamePlugin {\n    return &PluginNamePlugin{\n        name:  \"plugin_name\",\n        ports: []int{default_port},\n    }\n}\n\n// 实现Plugin接口\nfunc (p *PluginNamePlugin) GetName() string { return p.name }\nfunc (p *PluginNamePlugin) GetPorts() []int { return p.ports }\n\nfunc (p *PluginNamePlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 如果禁用暴力破解，只做服务识别\n    if common.DisableBrute {\n        return p.identifyService(info)\n    }\n\n    // 生成测试凭据\n    credentials := GenerateCredentials(\"plugin_name\")\n    \n    // 逐个测试凭据\n    for _, cred := range credentials {\n        select {\n        case <-ctx.Done():\n            return &ScanResult{Success: false, Error: ctx.Err()}\n        default:\n        }\n\n        if p.testCredential(ctx, info, cred) {\n            return &ScanResult{\n                Success:  true,\n                Service:  \"plugin_name\",\n                Username: cred.Username,\n                Password: cred.Password,\n            }\n        }\n    }\n\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 核心认证逻辑\nfunc (p *PluginNamePlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool {\n    // 实现具体的认证测试逻辑\n    return false\n}\n\n// 服务识别（-nobr模式）\nfunc (p *PluginNamePlugin) identifyService(info *common.HostInfo) *ScanResult {\n    // 实现服务识别逻辑\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 自动注册\nfunc init() {\n    RegisterPlugin(\"plugin_name\", func() Plugin {\n        return NewPluginNamePlugin()\n    })\n}\n```\n\n### 2. 带利用功能的插件（如SSH）\n\n```go\npackage plugins\n\n// SSH插件结构\ntype SSHPlugin struct {\n    name  string\n    ports []int\n}\n\n// 同时实现Plugin和Exploiter接口\nfunc (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 扫描逻辑（同上）\n}\n\nfunc (p *SSHPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult {\n    // 建立SSH连接\n    client, err := p.connectSSH(info, creds)\n    if err != nil {\n        return &ExploitResult{Success: false, Error: err}\n    }\n    defer client.Close()\n\n    // 执行命令或其他利用操作\n    output, err := p.executeCommand(client, \"whoami\")\n    return &ExploitResult{\n        Success: err == nil,\n        Output:  output,\n        Error:   err,\n    }\n}\n\n// 辅助方法\nfunc (p *SSHPlugin) connectSSH(info *common.HostInfo, creds Credential) (*ssh.Client, error) {\n    // SSH连接实现\n}\n\nfunc (p *SSHPlugin) executeCommand(client *ssh.Client, cmd string) (string, error) {\n    // 命令执行实现\n}\n```\n\n## 开发规范\n\n### 文件组织\n\n```\nplugins/\n├── base.go           # 核心接口和注册系统\n├── mysql.go          # MySQL插件\n├── ssh.go            # SSH插件  \n├── redis.go          # Redis插件\n└── README.md         # 开发文档（本文件）\n```\n\n### 命名规范\n\n- **插件文件**：`{service_name}.go`\n- **插件结构体**：`{ServiceName}Plugin`\n- **构造函数**：`New{ServiceName}Plugin()`\n- **插件名称**：小写，与文件名一致\n\n### 代码规范\n\n1. **错误处理**：始终使用Context进行超时控制\n2. **日志输出**：成功时使用 `common.LogSuccess`，调试用 `common.LogDebug`\n3. **凭据生成**：使用 `GenerateCredentials(service_name)` 生成测试凭据\n4. **资源管理**：及时关闭连接，使用 defer 确保清理\n\n### 测试要求\n\n每个插件必须支持：\n\n1. **暴力破解模式**：`common.DisableBrute = false`\n2. **服务识别模式**：`common.DisableBrute = true`\n3. **Context超时处理**：正确响应 `ctx.Done()`\n4. **代理支持**：如果 `common.Socks5Proxy` 不为空\n\n## 迁移指南\n\n### 从三文件架构迁移\n\n1. **提取核心逻辑**：从 connector.go 提取认证逻辑\n2. **合并实现**：将 plugin.go 中的组装逻辑内联\n3. **删除垃圾**：删除空的 exploiter.go\n4. **简化数据结构**：只保留必要的字段\n\n### 从Legacy插件迁移\n\n1. **保留核心逻辑**：复制扫描和认证的核心算法\n2. **标准化接口**：实现统一的Plugin接口  \n3. **移除全局依赖**：通过返回值而不是全局变量传递结果\n4. **统一日志**：使用统一的日志接口\n\n## 性能优化\n\n1. **连接复用**：在同一次扫描中复用连接\n2. **内存管理**：及时释放不需要的资源\n3. **并发控制**：通过Context控制并发度\n4. **超时设置**：合理设置各阶段超时时间\n\n## 示例\n\n参考 `mysql.go` 作为标准的纯扫描插件实现\n参考 `ssh.go` 作为带利用功能的插件实现\n\n---\n\n**记住：好的代码不是写出来的，是重构出来的。消除所有不必要的复杂性，直击问题本质。**","isInternal":false,"tokens":2073,"sizeBytes":6855},{"name":"README.md","path":"plugins/services/README.md","rawUrl":"https://raw.githubusercontent.com/shadow1ng/fscan/HEAD/plugins/services/README.md","title":"services Documentation","category":"plugin-manifest","format":"markdown","content":"# 服务扫描插件目录\n\n本目录包含所有服务扫描插件，采用简化的单文件插件架构。\n\n## 已实现插件\n\n### 数据库服务\n- `mysql.go` - MySQL数据库扫描\n- `postgresql.go` - PostgreSQL数据库扫描  \n- `redis.go` - Redis内存数据库扫描\n- `mongodb.go` - MongoDB文档数据库扫描\n- `mssql.go` - Microsoft SQL Server扫描\n- `oracle.go` - Oracle数据库扫描\n- `memcached.go` - Memcached缓存扫描\n- `neo4j.go` - Neo4j图数据库扫描\n\n### 消息队列服务\n- `rabbitmq.go` - RabbitMQ消息队列扫描\n- `activemq.go` - ActiveMQ消息队列扫描\n- `kafka.go` - Apache Kafka扫描\n\n### 网络服务\n- `ssh.go` - SSH远程登录服务扫描\n- `ftp.go` - FTP文件传输服务扫描\n- `telnet.go` - Telnet远程终端服务扫描\n- `smtp.go` - SMTP邮件服务扫描\n- `snmp.go` - SNMP网络管理协议扫描\n- `ldap.go` - LDAP目录服务扫描\n- `rsync.go` - Rsync文件同步服务扫描\n\n### Windows服务\n- `findnet.go` - Windows网络发现插件 (RPC端点映射)\n- `smbinfo.go` - SMB协议信息收集插件\n\n### 其他服务\n- `vnc.go` - VNC远程桌面服务扫描\n- `cassandra.go` - Apache Cassandra数据库扫描\n\n## 插件特性\n\n每个插件都包含：\n- ✅ 服务识别功能\n- ✅ 弱密码检测功能\n- ✅ 完整的利用功能\n- ✅ 错误处理和超时控制\n- ✅ 统一的结果输出格式\n\n## 开发规范\n\n所有插件都遵循 `../README.md` 中定义的开发规范。","isInternal":false,"tokens":552,"sizeBytes":1449}],"systemPromptSnippet":"<yakaai_skills repo=\"shadow1ng/fscan\">\n<!-- File: plugins/local/auto.json (Tokens: ~13624 | Category: anthropic-skill) -->\n{\n    \"ALYac\": {\n        \"processes\": [\n            \"aylaunch.exe\",\n            \"ayupdate2.exe\",\n            \"AYRTSrv.exe\",\n            \"AYAgent.exe\"\n        ],\n        \"url\": \"https://en.estsecurity.com/\"\n    },\n    \"AVG\": {\n        \"processes\": [\n            \"AVGSvc.exe\",\n            \"AVGUI.exe\",\n            \"avgwdsvc.exe\",\n            \"avg.exe\",\n            \"avgaurd.exe\",\n            \"avgemc.exe\",\n            \"avgrsx.exe\",\n            \"avgserv.exe\",\n            \"avgw.exe\"\n        ],\n        \"url\": \"https://www.avg.com/\"\n    },\n    \"Acronis\": {\n        \"processes\": [\n            \"arsm.exe\",\n            \"acronis_license_service.exe\"\n        ],\n        \"url\": \"https://www.acronis.com/\"\n    },\n    \"Ad-Aware\": {\n        \"processes\": [\n            \"AdAwareService.exe\",\n            \"Ad-Aware.exe\",\n            \"AdAware.exe\"\n        ],\n        \"url\": \"https://www.adaware.com/\"\n    },\n    \"AhnLab-V3\": {\n        \"processes\": [\n            \"patray.exe\",\n            \"V3Svc.exe\"\n        ],\n        \"url\": \"https://global.ahnlab.com/site/main.do\"\n    },\n    \"Arcabit\": {\n        \"processes\": [\n            \"arcavir.exe\",\n            \"arcadc.exe\",\n            \"ArcaVirMaster.exe\",\n            \"ArcaMainSV.exe\",\n            \"ArcaTasksService.exe\"\n        ],\n        \"url\": \"https://www.arcabit.pl\"\n    },\n    \"Avast\": {\n        \"processes\": [\n            \"ashDisp.exe\",\n            \"AvastUI.exe\",\n            \"AvastSvc.exe\",\n            \"AvastBrowser.exe\",\n            \"AfwServ.exe\"\n        ],\n        \"url\": \"https://www.avast.com\"\n    },\n    \"Avira AntiVirus(小红伞)\": {\n        \"processes\": [\n            \"avcenter.exe\",\n            \"avguard.exe\",\n            \"avgnt.exe\",\n            \"sched.exe\"\n        ],\n        \"url\": \"https://www.avira.com/\"\n    },\n    \"Baidu AntiVirus\": {\n        \"processes\": [\n            \"BaiduSdSvc.exe\",\n            \"BaiduSdTray.exe\",\n            \"BaiduSd.exe\",\n            \"bddownloader.exe\",\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"https://anquan.baidu.com/\"\n    },\n    \"BitDefender\": {\n        \"processes\": [\n            \"Bdagent.exe\",\n            \"BitDefenderCom.exe\",\n            \"vsserv.exe\",\n            \"bdredline.exe\",\n            \"secenter.exe\",\n            \"bdservicehost.exe\",\n            \"BITDEFENDER.exe\"\n        ],\n        \"url\": \"http://www.bitdefender.com/\"\n    },\n    \"Bkav\": {\n        \"processes\": [\n            \"BKavService.exe\",\n            \"Bka.exe\",\n            \"BkavUtil.exe\",\n            \"BLuPro.exe\"\n        ],\n        \"url\": \"https://www.bkav.com/\"\n    },\n    \"CAT-QuickHeal\": {\n        \"processes\": [\n            \"QUHLPSVC.exe\",\n            \"onlinent.exe\",\n            \"sapissvc.exe\",\n            \"scanwscs.exe\"\n        ],\n        \"url\": \"https://www.quickheal.com/\"\n    },\n    \"CMC\": {\n        \"processes\": [\n            \"CMCTrayIcon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/\"\n    },\n    \"ClamAV\": {\n        \"processes\": [\n            \"freshclam.exe\"\n        ],\n        \"url\": \"https://www.clamav.net\"\n    },\n    \"Comodo\": {\n        \"processes\": [\n            \"cpf.exe\",\n            \"cavwp.exe\",\n            \"ccavsrv.exe\",\n            \"cmdvirth.exe\"\n        ],\n        \"url\": \"https://www.comodo.com\"\n    },\n    \"CrowdStrike Falcon(猎鹰)\": {\n        \"processes\": [\n            \"csfalconservice.exe\",\n            \"CSFalconContainer.exe\"\n        ],\n        \"url\": \"https://www.crowdstrike.com\"\n    },\n    \"Cybereason\": {\n        \"processes\": [\n            \"CybereasonRansomFree.exe\",\n            \"CybereasonRansomFreeServiceHost.exe\",\n            \"CybereasonAV.exe\"\n        ],\n        \"url\": \"https://www.cybereason.com/\"\n    },\n    \"Cylance\": {\n        \"processes\": [\n            \"CylanceSvc.exe\"\n        ],\n        \"url\": \"https://www.cylance.com\"\n    },\n    \"Cyren\": {\n        \"processes\": [\n            \"vsedsps.exe\",\n            \"vseamps.exe\",\n            \"vseqrts.exe\"\n        ],\n        \"url\": \"http://www.cyren.com/\"\n    },\n    \"DrWeb\": {\n        \"processes\": [\n            \"drwebcom.exe\",\n            \"spidernt.exe\",\n            \"drwebscd.exe\",\n            \"drweb32w.exe\",\n            \"dwengine.exes\"\n        ],\n        \"url\": \"https://www.drweb.com/\"\n    },\n    \"Elastic Security\": {\n        \"processes\": [\n            \"elastic-endpoint.exe\",\n            \"elastic-agent.exe\",\n            \"agentbeat.exe\",\n            \"winlogbeat.exe\"\n        ],\n        \"url\": \"https://www.elastic.co/endpoint-detection-response\"\n    },\n    \"ESET-NOD32\": {\n        \"processes\": [\n            \"egui.exe\",\n            \"ecls.exe\",\n            \"ekrn.exe\",\n            \"eguiProxy.exe\",\n            \"EShaSrv.exe\"\n        ],\n        \"url\": \"https://www.eset.com/us/home/antivirus/\"\n    },\n    \"Trend Micro（趋势科技）\": {\n        \"processes\": [\n            \"tmpfw.exe\",\n            \"tmlisten.exe\",\n            \"coreServiceShell.exe\",\n            \"coreFrameworkHost.exe\",\n            \"uiWatchDog.exe\",\n            \"TMLISTEN.exe\"\n        ],\n        \"url\": \"https://www.trendmicro.com\"\n    },\n    \"Emsisoft\": {\n        \"processes\": [\n            \"a2guard.exe\",\n            \"a2free.exe\",\n            \"a2service.exe\"\n        ],\n        \"url\": \"https://www.emsisoft.com/\"\n    },\n    \"Endgame\": {\n        \"processes\": [\n            \"endgame.exe\"\n        ],\n        \"url\": \"https://www.endgame.com/\"\n    },\n    \"F-Prot\": {\n        \"processes\": [\n            \"F-PROT.exe\",\n            \"FProtTray.exe\",\n            \"FPAVServer.exe\",\n            \"f-stopw.exe\",\n            \"f-prot95.exe\",\n            \"f-agnt95.exe\"\n        ],\n        \"url\": \"http://f-prot.com/\"\n    },\n    \"F-Secure\": {\n        \"processes\": [\n            \"f-secure.exe\",\n            \"fssm32.exe\",\n            \"Fsorsp64.exe\",\n            \"fsavgui.exe\",\n            \"fameh32.exe\",\n            \"fch32.exe\",\n            \"fih32.exe\",\n            \"fnrb32.exe\",\n            \"fsav32.exe\",\n            \"fsma32.exe\",\n            \"fsmb32.exe\"\n        ],\n        \"url\": \"https://www.f-secure.com\"\n    },\n    \"FireEye(火眼)\": {\n        \"processes\": [\n            \"xagtnotif.exe\",\n            \"xagt.exe\"\n        ],\n        \"url\": \"https://www.fireeye.com\"\n    },\n    \"Trellix EDR(McAfee && 火眼)\": {\n        \"processes\": [\n            \"macmnsvc.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcshield.exe\",\n            \"mctray.exe\",\n            \"mfeatp.exe\",\n            \"mfeensppl.exe\",\n            \"mfeesp.exe\",\n            \"mfefw.exe\",\n            \"mfehcs.exe\",\n            \"mfemactl.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfevtps.exe\",\n            \"mfewch.exe\",\n            \"updaterui.exe\"\n        ],\n        \"url\": \"https://www.trellix.com\"\n    },\n    \"Fortinet（飞塔）\": {\n        \"processes\": [\n            \"FortiClient.exe\",\n            \"FortiTray.exe\",\n            \"FortiScand.exe\",\n            \"FortiWF.exe\",\n            \"FortiProxy.exe\",\n            \"FortiESNAC.exe\",\n            \"FortiSSLVPNdaemon.exe\",\n            \"FortiTcs.exe\",\n            \"FctSecSvr.exe\"\n        ],\n        \"url\": \"https://fortiguard.com/\"\n    },\n    \"GData\": {\n        \"processes\": [\n            \"AVK.exe\",\n            \"avkcl.exe\",\n            \"avkpop.exe\",\n            \"avkservice.exe\",\n            \"GDScan.exe\",\n            \"AVKWCtl.exe\",\n            \"AVKProxy.exe\",\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"https://www.gdatasoftware.com/\"\n    },\n    \"Ikarus\": {\n        \"processes\": [\n            \"guardxservice.exe\",\n            \"guardxkickoff.exe\"\n        ],\n        \"url\": \"https://www.ikarussecurity.com/\"\n    },\n    \"Jiangmin\": {\n        \"processes\": [\n            \"KVFW.exe\",\n            \"KVsrvXP.exe\",\n            \"KVMonXP.exe\",\n            \"KVwsc.exe\"\n        ],\n        \"url\": \"https://www.jiangmin.com/\"\n    },\n    \"K7AntiVirus\": {\n        \"processes\": [\n            \"K7TSecurity.exe\",\n            \"K7TSMain.Exe\",\n            \"K7TSUpdT.exe\"\n        ],\n        \"url\": \"http://viruslab.k7computing.com/\"\n    },\n    \"Kaspersky(卡巴斯基)\": {\n        \"processes\": [\n            \"avp.exe\",\n            \"avpcc.exe\",\n            \"avpm.exe\",\n            \"kavpf.exe\",\n            \"kavfs.exe\",\n            \"klnagent.exe\",\n            \"kavtray.exe\",\n            \"kavfswp.exe\",\n            \"kaspersky.exe\"\n        ],\n        \"url\": \"https://www.kaspersky.com\"\n    },\n    \"Max Secure Software\": {\n        \"processes\": [\n            \"SDSystemTray.exe\",\n            \"MaxRCSystemTray.exe\",\n            \"RCSystemTray.exe\",\n            \"MaxAVPlusDM.exe\",\n            \"LiveUpdateSD.exe\"\n        ],\n        \"url\": \"https://www.maxpcsecure.com/\"\n    },\n    \"Malwarebytes\": {\n        \"processes\": [\n            \"MBAMService.exe\",\n            \"mbam.exe\",\n            \"mbamtray.exe\"\n        ],\n        \"url\": \"https://www.malwarebytes.com/\"\n    },\n    \"McAfee(迈克菲-可能为Trellix)\": {\n        \"processes\": [\n            \"Mcshield.exe\",\n            \"Tbmon.exe\",\n            \"Frameworkservice.exe\",\n            \"firesvc.exe\",\n            \"firetray.exe\",\n            \"hipsvc.exe\",\n            \"mfevtps.exe\",\n            \"mcafeefire.exe\",\n            \"shstat.exe\",\n            \"vstskmgr.exe\",\n            \"engineserver.exe\",\n            \"alogserv.exe\",\n            \"avconsol.exe\",\n            \"cmgrdian.exe\",\n            \"cpd.exe\",\n            \"mcmnhdlr.exe\",\n            \"mcvsshld.exe\",\n            \"mcvsrte.exe\",\n            \"mghtml.exe\",\n            \"mpfservice.exe\",\n            \"mpfagent.exe\",\n            \"mpftray.exe\",\n            \"vshwin32.exe\",\n            \"vsstat.exe\",\n            \"guarddog.exe\",\n            \"mfeann.exe\",\n            \"udaterui.exe\",\n            \"naprdmgr.exe\",\n            \"mctray.exe\",\n            \"fcagate.exe\",\n            \"fcag.exe\",\n            \"fcags.exe\",\n            \"fcagswd.exe\",\n            \"macompatsvc.exe\",\n            \"masvc.exe\",\n            \"mcamnsvc.exe\",\n            \"mctary.exe\",\n            \"mfecanary.exe\",\n            \"mfeconsole.exe\",\n            \"mfeesp.exe\",\n            \"mfefire.exe\",\n            \"mfefw.exe\",\n            \"mfemms.exe\",\n            \"mfetp.exe\",\n            \"mfewc.exe\",\n            \"mfewch.exe\"\n        ],\n        \"url\": \"https://www.mcafee.com/en-us\"\n    },\n    \"Microsoft Defender(Windows Defender)\": {\n        \"processes\": [\n            \"MsMpEng.exe\",\n            \"msseces.exe\",\n            \"mssecess.exe\",\n            \"emet_agent.exe\",\n            \"emet_service.exe\",\n            \"drwatson.exe\",\n            \"MpCmdRun.exe\",\n            \"NisSrv.exe\",\n            \"MsSense.exe\",\n            \"MSASCui.exe\",\n            \"MSASCuiL.exe\",\n            \"SecurityHealthService.exe\"\n        ],\n        \"url\": \"https://www.microsoft.com/en-us/windows/comprehensive-security\"\n    },\n    \"NANO-Antivirus\": {\n        \"processes\": [\n            \"nanoav.exe\",\n            \"nanoav64.exe\",\n            \"nanoreport.exe\",\n            \"nanoreportc.exe\",\n            \"nanoreportc64.exe\",\n            \"nanorst.exe\",\n            \"nanosvc.exe\"\n        ],\n        \"url\": \"https://nano-av.com/\"\n    },\n    \"Palo Alto Networks\": {\n        \"processes\": [\n            \"PanInstaller.exe\"\n        ],\n        \"url\": \"https://www.paloaltonetworks.com/\"\n    },\n    \"Panda Security\": {\n        \"processes\": [\n            \"remupd.exe\",\n            \"apvxdwin.exe\",\n            \"pavproxy.exe\",\n            \"pavsched.exe\"\n        ],\n        \"url\": \"https://www.pandasecurity.com/\"\n    },\n    \"Qihoo-360\": {\n        \"processes\": [\n            \"360sd.exe\",\n            \"360tray.exe\",\n            \"ZhuDongFangYu.exe\",\n            \"360rp.exe\",\n            \"360rps.exe\",\n            \"360safe.exe\",\n            \"360safebox.exe\",\n            \"QHActiveDefense.exe\",\n            \"360skylarsvc.exe\",\n            \"LiveUpdate360.exe\"\n        ],\n        \"url\": \"https://sd.360.cn/\"\n    },\n    \"Rising\": {\n        \"processes\": [\n            \"RavMonD.exe\",\n            \"rfwmain.exe\",\n            \"RsMgrSvc.exe\",\n            \"RavMon.exe\"\n        ],\n        \"url\": \"http://antivirus.rising.com.cn/\"\n    },\n    \"SUPERAntiSpyware\": {\n        \"processes\": [\n            \"superantispyware.exe\",\n            \"sascore.exe\",\n            \"SAdBlock.exe\",\n            \"sabsvc.exe\"\n        ],\n        \"url\": \"http://www.superadblocker.com/\"\n    },\n    \"SecureAge APEX\": {\n        \"processes\": [\n            \"UniversalAVService.exe\",\n            \"EverythingServer.exe\",\n            \"clamd.exe\"\n        ],\n        \"url\": \"https://www.secureage.com/\"\n    },\n    \"Sophos AV\": {\n        \"processes\": [\n            \"SavProgress.exe\",\n            \"icmon.exe\",\n            \"SavMain.exe\",\n            \"SophosUI.exe\",\n            \"SophosFS.exe\",\n            \"SophosHealth.exe\",\n            \"SophosSafestore64.exe\",\n            \"SophosCleanM.exe\",\n            \"SophosFileScanner.exe\",\n            \"SophosNtpService.exe\",\n            \"SophosOsquery.exe\",\n            \"Sophos UI.exe\"\n        ],\n        \"url\": \"https://www.sophos.com/\"\n    },\n    \"TACHYON\": {\n        \"processes\": [],\n        \"url\": \"https://www.tachyonlab.com/en/index.html\"\n    },\n    \"Tencent\": {\n        \"processes\": [\n            \"QQPCRTP.exe\",\n            \"QQPCTray.exe\",\n            \"QQPCMgr.exe\",\n            \"QQPCNetFlow.exe\",\n            \"QQPCRealTimeSpeedup.exe\"\n        ],\n        \"url\": \"https://guanjia.qq.com\"\n    },\n    \"TotalDefense\": {\n        \"processes\": [\n            \"AMRT.exe\",\n            \"SWatcherSrv.exe\",\n            \"Prd.ManagementConsole.exe\"\n        ],\n        \"url\": \"https://www.totaldefense.com\"\n    },\n    \"Trapmine\": {\n        \"processes\": [\n            \"TrapmineEnterpriseService.exe\",\n            \"TrapmineEnterpriseConfig.exe\",\n            \"TrapmineDeployer.exe\",\n            \"TrapmineUpgradeService.exe\"\n        ],\n        \"url\": \"https://trapmine.com/\"\n    },\n    \"TrendMicro\": {\n        \"processes\": [\n            \"TMBMSRV.exe\",\n            \"ntrtscan.exe\",\n            \"Pop3Trap.exe\",\n            \"WebTrap.exe\",\n            \"PccNTMon.exe\"\n        ],\n        \"url\": \"http://careers.trendmicro.com.cn/\"\n    },\n    \"VIPRE\": {\n        \"processes\": [\n            \"SBAMSvc.exe\",\n            \"VipreEdgeProtection.exe\",\n            \"SBAMTray.exe\"\n        ],\n        \"url\": \"https://www.vipre.com\"\n    },\n    \"ViRobot\": {\n        \"processes\": [\n            \"vrmonnt.exe\",\n            \"vrmonsvc.exe\",\n            \"Vrproxyd.exe\"\n        ],\n        \"url\": \"http://www.hauri.net/\"\n    },\n    \"Webroot\": {\n        \"processes\": [\n            \"npwebroot.exe\",\n            \"WRSA.exe\",\n            \"spysweeperui.exe\"\n        ],\n        \"url\": \"https://www.webroot.com/us/en\"\n    },\n    \"Yandex\": {\n        \"processes\": [\n            \"Yandex.exe\",\n            \"YandexDisk.exe\",\n            \"yandesk.exe\"\n        ],\n        \"url\": \"https://yandex.com/support/common/security/antiviruses-free.html\"\n    },\n    \"Zillya\": {\n        \"processes\": [\n            \"zillya.exe\",\n            \"ZAVAux.exe\",\n            \"ZAVCore.exe\"\n        ],\n        \"url\": \"https://zillya.com\"\n    },\n    \"ZoneAlarm\": {\n        \"processes\": [\n            \"vsmon.exe\",\n            \"zapro.exe\",\n            \"zonealarm.exe\"\n        ],\n        \"url\": \"https://www.zonealarm.com/\"\n    },\n    \"Zoner\": {\n        \"processes\": [\n            \"ZPSTray.exe\"\n        ],\n        \"url\": \"https://zonerantivirus.com/\"\n    },\n    \"eGambit\": {\n        \"processes\": [\n            \"dasc.exe\",\n            \"memscan64.exe\",\n            \"dastray.exe\"\n        ],\n        \"url\": \"https://egambit.app/en/\"\n    },\n    \"eScan\": {\n        \"processes\": [\n            \"consctl.exe\",\n            \"mwaser.exe\",\n            \"avpmapp.exe\"\n        ],\n        \"url\": \"https://www.escanav.com/\"\n    },\n    \"Lavasoft\": {\n        \"processes\": [\n            \"AAWTray.exe\",\n            \"LavasoftTcpService.exe\",\n            \"AdAwareTray.exe\",\n            \"WebCompanion.exe\",\n            \"WebCompanionInstaller.exe\",\n            \"adawarebp.exe\",\n            \"ad-watch.exe\"\n        ],\n        \"url\": \"https://www.lavasoft.com/\"\n    },\n    \"The Cleaner\": {\n        \"processes\": [\n            \"cleaner8.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"VBA32\": {\n        \"processes\": [\n            \"vba32lder.exe\"\n        ],\n        \"url\": \"http://www.anti-virus.by/en/index.shtml\"\n    },\n    \"Mongoosa\": {\n        \"processes\": [\n            \"MongoosaGUI.exe\",\n            \"mongoose.exe\"\n        ],\n        \"url\": \"https://www.securitymongoose.com/\"\n    },\n    \"Coranti2012\": {\n        \"processes\": [\n            \"CorantiControlCenter32.exe\"\n        ],\n        \"url\": \"https://www.coranti.com\"\n    },\n    \"UnThreat\": {\n        \"processes\": [\n            \"UnThreat.exe\",\n            \"utsvc.exe\"\n        ],\n        \"url\": \"https://softplanet.com/UnThreat-AntiVirus\"\n    },\n    \"Shield Antivirus\": {\n        \"processes\": [\n            \"CKSoftShiedAntivirus4.exe\",\n            \"shieldtray.exe\"\n        ],\n        \"url\": \"https://shieldapps.com/supportmain/shield-antivirus-support/\"\n    },\n    \"VIRUSfighter\": {\n        \"processes\": [\n            \"AVWatchService.exe\",\n            \"vfproTray.exe\"\n        ],\n        \"url\": \"https://www.spamfighter.com/VIRUSfighter/\"\n    },\n    \"Immunet\": {\n        \"processes\": [\n            \"iptray.exe\"\n        ],\n        \"url\": \"https://www.immunet.com/index\"\n    },\n    \"PSafe\": {\n        \"processes\": [\n            \"PSafeSysTray.exe\",\n            \"PSafeCategoryFinder.exe\",\n            \"psafesvc.exe\"\n        ],\n        \"url\": \"https://www.psafe.com/\"\n    },\n    \"nProtect\": {\n        \"processes\": [\n            \"nspupsvc.exe\",\n            \"Npkcmsvc.exe\",\n            \"npnj5Agent.exe\"\n        ],\n        \"url\": \"http://nos.nprotect.com/\"\n    },\n    \"Spyware Terminator\": {\n        \"processes\": [\n            \"SpywareTerminatorShield.exe\",\n            \"SpywareTerminator.exe\"\n        ],\n        \"url\": \"http://www.spywareterminator.com/Default.aspx\"\n    },\n    \"Norton（赛门铁克）\": {\n        \"processes\": [\n            \"ccSvcHst.exe\",\n            \"rtvscan.exe\",\n            \"ccapp.exe\",\n            \"NPFMntor.exe\",\n            \"ccRegVfy.exe\",\n            \"vptray.exe\",\n            \"iamapp.exe\",\n            \"nav.exe\",\n            \"navapw32.exe\",\n            \"navapsvc.exe\",\n            \"nisum.exe\",\n            \"nmain.exe\",\n            \"nprotect.exe\",\n            \"smcGui.exe\",\n            \"ns.exe\",\n            \"nortonsecurity.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n        \"Norton V25（Avast）\": {\n        \"processes\": [\n            \"afwServ.exe\",\n            \"aswEngSrv.exe\",\n            \"aswidsagent.exe\",\n            \"AvDump.exe\",\n            \"nllToolsSvc.exe\",\n            \"NortonSvc.exe\",\n            \"wsc_proxy.exe\"\n        ],\n        \"url\": \"https://us.norton.com/\"\n    },\n    \"Symantec（赛门铁克）\": {\n        \"processes\": [\n            \"ccSetMgr.exe\",\n            \"ccapp.exe\",\n            \"vptray.exe\",\n            \"ccpxysvc.exe\",\n            \"cfgwiz.exe\",\n            \"smc.exe\",\n            \"symproxysvc.exe\",\n            \"vpc32.exe\",\n            \"lsetup.exe\",\n            \"luall.exe\",\n            \"lucomserver.exe\",\n            \"sbserv.exe\",\n            \"ccEvtMgr.exe\",\n            \"smcGui.exe\",\n            \"snac.exe\",\n            \"SymCorpUI.exe\",\n            \"sepWscSvc64.exe\"\n        ],\n        \"url\": \"http://www.symantec.com/\"\n    },\n    \"可牛杀毒\": {\n        \"processes\": [\n            \"knsdtray.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E5%8F%AF%E7%89%9B%E5%85%8D%E8%B4%B9%E6%9D%80%E6%AF%92%E8%BD%AF%E4%BB%B6\"\n    },\n    \"流量矿石\": {\n        \"processes\": [\n            \"Miner.exe\"\n        ],\n        \"url\": \"https://jiaoyi.yunfan.com/\"\n    },\n    \"SafeDog(安全狗)\": {\n        \"processes\": [\n            \"safedog.exe\",\n            \"SafeDogGuardCenter.exe\",\n            \"SafeDogSiteIIS.exe\",\n            \"SafeDogTray.exe\",\n            \"SafeDogServerUI.exe\",\n            \"SafeDogSiteApache.exe\",\n            \"CloudHelper.exe\",\n            \"SafeDogUpdateCenter.exe\"\n        ],\n        \"url\": \"http://www.safedog.cn/\"\n    },\n    \"木马克星\": {\n        \"processes\": [\n            \"parmor.exe\",\n            \"Iparmor.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E6%9C%A8%E9%A9%AC%E5%85%8B%E6%98%9F/2979824?fr=aladdin\"\n    },\n    \"贝壳云安全\": {\n        \"processes\": [\n            \"beikesan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"木马猎手\": {\n        \"processes\": [\n            \"TrojanHunter.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"巨盾网游安全盾\": {\n        \"processes\": [\n            \"GG.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"绿鹰安全精灵\": {\n        \"processes\": [\n            \"adam.exe\"\n        ],\n        \"url\": \"https://baike.baidu.com/item/%E7%BB%BF%E9%B9%B0%E5%AE%89%E5%85%A8%E7%B2%BE%E7%81%B5\"\n    },\n    \"超级巡警\": {\n        \"processes\": [\n            \"AST.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"墨者安全专家\": {\n        \"processes\": [\n            \"ananwidget.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"风云防火墙\": {\n        \"processes\": [\n            \"FYFireWall.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"微点主动防御\": {\n        \"processes\": [\n            \"MPMon.exe\"\n        ],\n        \"url\": \"http://www.micropoint.com.cn/\"\n    },\n    \"天网防火墙\": {\n        \"processes\": [\n            \"pfw.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"D 盾\": {\n        \"processes\": [\n            \"D_Safe_Manage.exe\",\n            \"d_manage.exe\"\n        ],\n        \"url\": \"http://www.d99net.net/\"\n    },\n    \"云锁\": {\n        \"processes\": [\n            \"yunsuo_agent_service.exe\",\n            \"yunsuo_agent_daemon.exe\"\n        ],\n        \"url\": \"https://www.yunsuo.com.cn/\"\n    },\n    \"护卫神\": {\n        \"processes\": [\n            \"HwsPanel.exe\",\n            \"hws_ui.exe\",\n            \"hws.exe\",\n            \"hwsd.exe\",\n            \"HwsHostPanel.exe\",\n            \"HwsHostMaster.exe\"\n        ],\n        \"url\": \"https://www.hws.com/\"\n    },\n    \"火绒安全\": {\n        \"processes\": [\n            \"hipstray.exe\",\n            \"wsctrl.exe\",\n            \"usysdiag.exe\",\n            \"HipsDaemon.exe\",\n            \"HipsLog.exe\",\n            \"HipsMain.exe\",\n            \"wsctrlsvc.exe\"\n        ],\n        \"url\": \"https://www.huorong.cn/\"\n    },\n    \"网络病毒克星\": {\n        \"processes\": [\n            \"WEBSCANX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"SPHINX防火墙\": {\n        \"processes\": [\n            \"SPHINX.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"奇安信天擎\": {\n        \"processes\": [\n            \"TQClient.exe\",\n            \"TQTray.exe\",\n            \"QaxEngManager.exe\",\n            \"TQDefender.exe\"\n        ],\n        \"url\": \"https://www.qianxin.com/product/detail/pid/330\"\n    },\n    \"H+BEDV Datentechnik GmbH\": {\n        \"processes\": [\n            \"avwin.exe\",\n            \"avwupsrv.exe\"\n        ],\n        \"url\": \"http://www.free-av.com/\"\n    },\n    \"IBM ISS Proventia\": {\n        \"processes\": [\n            \"blackd.exe\",\n            \"rapapp.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"eEye Digital Security\": {\n        \"processes\": [\n            \"eeyeevnt.exe\",\n            \"blink.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"TamoSoft\": {\n        \"processes\": [\n            \"cv.exe\",\n            \"ent.exe\"\n        ],\n        \"url\": \"https://www.tamos.com/\"\n    },\n    \"Kerio Personal Firewall\": {\n        \"processes\": [\n            \"persfw.exe\",\n            \"wrctrl.exe\"\n        ],\n        \"url\": \"http://www.kerio.com/\"\n    },\n    \"Simplysup\": {\n        \"processes\": [\n            \"Trjscan.exe\"\n        ],\n        \"url\": \"https://www.simplysup.com/\"\n    },\n    \"PC Tools AntiVirus\": {\n        \"processes\": [\n            \"PCTAV.exe\",\n            \"pctsGui.exe\"\n        ],\n        \"url\": \"http://www.pctools.com\"\n    },\n    \"VirusBuster Professional\": {\n        \"processes\": [\n            \"vbcmserv.exe\"\n        ],\n        \"url\": \"http://www.virusbuster.hu\"\n    },\n    \"ClamWin\": {\n        \"processes\": [\n            \"ClamTray.exe\",\n            \"clamscan.exe\"\n        ],\n        \"url\": \"http://www.clamwin.com/\"\n    },\n    \"安天智甲\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kscan.exe\",\n            \"AMediumManager.exe\",\n            \"kismain.exe\"\n        ],\n        \"url\": \"https://antiy.cn/\"\n    },\n    \"CMC Endpoint Security\": {\n        \"processes\": [\n            \"CMCNECore.exe\",\n            \"cmcepagent.exe\",\n            \"cmccore.exe\",\n            \"CMCLog.exe\",\n            \"CMCFMon.exe\"\n        ],\n        \"url\": \"https://cmccybersecurity.com/giai-phap/\"\n    },\n    \"金山毒霸\": {\n        \"processes\": [\n            \"kxetray.exe\",\n            \"kxescore.exe\",\n            \"kupdata.exe\",\n            \"kwsprotect64.exe\",\n            \"kislive.exe\",\n            \"knewvip.exe\",\n            \"kscan.exe\",\n            \"kxecenter.exe\",\n            \"kxemain.exe\",\n            \"KWatch.exe\",\n            \"KSafeSvc.exe\",\n            \"KSafeTray.exe\"\n        ],\n        \"url\": \"http://www.ijinshan.com/\"\n    },\n    \"Agnitum outpost (Outpost Firewall)\": {\n        \"processes\": [\n            \"outpost.exe\",\n            \"acs.exe\"\n        ],\n        \"url\": \"https://agnitum-outpost-security-suite.en.softonic.com/\"\n    },\n    \"Cynet\": {\n        \"processes\": [\n            \"CynetLauncher.exe\",\n            \"CynetDS.exe\",\n            \"CynetEPS.exe\",\n            \"CynetMS.exe\",\n            \"CynetAR.exe\",\n            \"CynetGW.exe\",\n            \"CynetSD64.exe\"\n        ],\n        \"url\": \"https://www.cynet.com/\"\n    },\n    \"金山网盾\": {\n        \"processes\": [\n            \"KSWebShield.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data安全软件客户端\": {\n        \"processes\": [\n            \"AVK.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"金山网镖\": {\n        \"processes\": [\n            \"kpfwtray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在扫1433\": {\n        \"processes\": [\n            \"1433.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"在爆破\": {\n        \"processes\": [\n            \"DUB.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"发现S-U\": {\n        \"processes\": [\n            \"ServUDaemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士\": {\n        \"processes\": [\n            \"bddownloader.exe\",\n            \"baiduSafeTray.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"百度卫士-主进程\": {\n        \"processes\": [\n            \"baiduansvx.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"已知杀软进程,名称暂未收录\": {\n        \"processes\": [\n            \"scan32.exe\",\n            \"mcscript.exe\",\n            \"cleanup.exe\",\n            \"cmdagent.exe\",\n            \"frminst.exe\",\n            \"mcscript_inuse.exe\",\n            \"_avp32.exe\",\n            \"_avpcc.exe\",\n            \"_avpm.exe\",\n            \"aAvgApi.exe\",\n            \"ackwin32.exe\",\n            \"advxdwin.exe\",\n            \"agentsvr.exe\",\n            \"agentw.exe\",\n            \"alertsvc.exe\",\n            \"alevir.exe\",\n            \"amon9x.exe\",\n            \"anti-trojan.exe\",\n            \"antivirus.exe\",\n            \"ants.exe\",\n            \"apimonitor.exe\",\n            \"aplica32.exe\",\n            \"arr.exe\",\n            \"atcon.exe\",\n            \"atguard.exe\",\n            \"atro55en.exe\",\n            \"atupdater.exe\",\n            \"atwatch.exe\",\n            \"au.exe\",\n            \"aupdate.exe\",\n            \"auto-protect.nav80try.exe\",\n            \"autodown.exe\",\n            \"autotrace.exe\",\n            \"autoupdate.exe\",\n            \"ave32.exe\",\n            \"avgcc32.exe\",\n            \"avgctrl.exe\",\n            \"avgserv9.exe\",\n            \"avkpop.exe\",\n            \"avkserv.exe\",\n            \"avkservice.exe\",\n            \"avltmain.exe\",\n            \"avnt.exe\",\n            \"avp32.exe\",\n            \"avpdos32.exe\",\n            \"avptc32.exe\",\n            \"avpupd.exe\",\n            \"avsched32.exe\",\n            \"avsynmgr.exe\",\n            \"avwin95.exe\",\n            \"avwinnt.exe\",\n            \"avwupd.exe\",\n            \"avwupd32.exe\",\n            \"avxmonitor9x.exe\",\n            \"avxmonitornt.exe\",\n            \"avxquar.exe\",\n            \"backweb.exe\",\n            \"bargains.exe\",\n            \"bd_professional.exe\",\n            \"beagle.exe\",\n            \"belt.exe\",\n            \"bidef.exe\",\n            \"bidserver.exe\",\n            \"bipcp.exe\",\n            \"bipcpevalsetup.exe\",\n            \"bisp.exe\",\n            \"blackice.exe\",\n            \"blss.exe\",\n            \"bootconf.exe\",\n            \"bootwarn.exe\",\n            \"borg2.exe\",\n            \"bpc.exe\",\n            \"brasil.exe\",\n            \"bs120.exe\",\n            \"bundle.exe\",\n            \"bvt.exe\",\n            \"cdp.exe\",\n            \"cfd.exe\",\n            \"cfiadmin.exe\",\n            \"cfiaudit.exe\",\n            \"cfinet.exe\",\n            \"cfinet32.exe\",\n            \"claw95.exe\",\n            \"claw95cf.exe\",\n            \"clean.exe\",\n            \"cleaner.exe\",\n            \"cleaner3.exe\",\n            \"cleanpc.exe\",\n            \"click.exe\",\n            \"cmesys.exe\",\n            \"cmon016.exe\",\n            \"connectionmonitor.exe\",\n            \"cpf9x206.exe\",\n            \"cpfnt206.exe\",\n            \"ctrl.exe\",\n            \"cwnb181.exe\",\n            \"cwntdwmo.exe\",\n            \"datemanager.exe\",\n            \"dcomx.exe\",\n            \"defalert.exe\",\n            \"defscangui.exe\",\n            \"defwatch.exe\",\n            \"deputy.exe\",\n            \"divx.exe\",\n            \"dllcache.exe\",\n            \"dllreg.exe\",\n            \"doors.exe\",\n            \"dpf.exe\",\n            \"dpfsetup.exe\",\n            \"dpps2.exe\",\n            \"drweb32.exe\",\n            \"drwebupw.exe\",\n            \"dssagent.exe\",\n            \"dvp95.exe\",\n            \"dvp95_0.exe\",\n            \"ecengine.exe\",\n            \"efpeadm.exe\",\n            \"emsw.exe\",\n            \"ent.exe\",\n            \"esafe.exe\",\n            \"escanhnt.exe\",\n            \"escanv95.exe\",\n            \"espwatch.exe\",\n            \"ethereal.exe\",\n            \"etrustcipe.exe\",\n            \"evpn.exe\",\n            \"exantivirus-cnet.exe\",\n            \"exe.avxw.exe\",\n            \"expert.exe\",\n            \"explore.exe\",\n            \"fast.exe\",\n            \"findviru.exe\",\n            \"firewall.exe\",\n            \"fp-win.exe\",\n            \"fp-win_trial.exe\",\n            \"fprot.exe\",\n            \"frw.exe\",\n            \"fsaa.exe\",\n            \"fsav.exe\",\n            \"fsav530stbyb.exe\",\n            \"fsav530wtbyb.exe\",\n            \"fsav95.exe\",\n            \"fsgk32.exe\",\n            \"fsm32.exe\",\n            \"gator.exe\",\n            \"gbmenu.exe\",\n            \"gbpoll.exe\",\n            \"generics.exe\",\n            \"gmt.exe\",\n            \"guard.exe\",\n            \"hacktracersetup.exe\",\n            \"hbinst.exe\",\n            \"hbsrv.exe\",\n            \"hotactio.exe\",\n            \"hotpatch.exe\",\n            \"htlog.exe\",\n            \"htpatch.exe\",\n            \"hwpe.exe\",\n            \"hxdl.exe\",\n            \"hxiul.exe\",\n            \"iamserv.exe\",\n            \"iamstats.exe\",\n            \"ibmasn.exe\",\n            \"ibmavsp.exe\",\n            \"icload95.exe\",\n            \"icloadnt.exe\",\n            \"icmon.exe\",\n            \"icsupp95.exe\",\n            \"icsuppnt.exe\",\n            \"idle.exe\",\n            \"iedll.exe\",\n            \"iedriver.exe\",\n            \"iface.exe\",\n            \"ifw2000.exe\",\n            \"inetlnfo.exe\",\n            \"infus.exe\",\n            \"infwin.exe\",\n            \"init.exe\",\n            \"intdel.exe\",\n            \"intren.exe\",\n            \"iomon98.exe\",\n            \"istsvc.exe\",\n            \"jammer.exe\",\n            \"jdbgmrg.exe\",\n            \"jedi.exe\",\n            \"kavlite40eng.exe\",\n            \"kavpers40eng.exe\",\n            \"kazza.exe\",\n            \"keenvalue.exe\",\n            \"kerio-pf-213-en-win.exe\",\n            \"kerio-wrl-421-en-win.exe\",\n            \"kerio-wrp-421-en-win.exe\",\n            \"kernel32.exe\",\n            \"killprocesssetup161.exe\",\n            \"launcher.exe\",\n            \"ldnetmon.exe\",\n            \"ldpro.exe\",\n            \"ldpromenu.exe\",\n            \"ldscan.exe\",\n            \"lnetinfo.exe\",\n            \"loader.exe\",\n            \"localnet.exe\",\n            \"lockdown.exe\",\n            \"lockdown2000.exe\",\n            \"lookout.exe\",\n            \"lordpe.exe\",\n            \"luau.exe\",\n            \"luinit.exe\",\n            \"luspt.exe\",\n            \"mapisvc32.exe\",\n            \"mcagent.exe\",\n            \"mctool.exe\",\n            \"mcupdate.exe\",\n            \"mfin32.exe\",\n            \"mfw2en.exe\",\n            \"mfweng3.02d30.exe\",\n            \"mgavrtcl.exe\",\n            \"mgavrte.exe\",\n            \"mgui.exe\",\n            \"minilog.exe\",\n            \"mmod.exe\",\n            \"monitor.exe\",\n            \"moolive.exe\",\n            \"mostat.exe\",\n            \"mrflux.exe\",\n            \"msapp.exe\",\n            \"msbb.exe\",\n            \"msblast.exe\",\n            \"mscache.exe\",\n            \"msccn32.exe\",\n            \"mscman.exe\",\n            \"msconfig.exe\",\n            \"msdm.exe\",\n            \"msdos.exe\",\n            \"msiexec16.exe\",\n            \"msinfo32.exe\",\n            \"mslaugh.exe\",\n            \"msmgt.exe\",\n            \"msmsgri32.exe\",\n            \"mssmmc32.exe\",\n            \"mssys.exe\",\n            \"msvxd.exe\",\n            \"mu0311ad.exe\",\n            \"mwatch.exe\",\n            \"n32scanw.exe\",\n            \"navap.navapsvc.exe\",\n            \"navdx.exe\",\n            \"navlu32.exe\",\n            \"navnt.exe\",\n            \"navstub.exe\",\n            \"navw32.exe\",\n            \"navwnt.exe\",\n            \"nc2000.exe\",\n            \"ncinst4.exe\",\n            \"ndd32.exe\",\n            \"neomonitor.exe\",\n            \"neowatchlog.exe\",\n            \"netarmor.exe\",\n            \"netd32.exe\",\n            \"netinfo.exe\",\n            \"netmon.exe\",\n            \"netscanpro.exe\",\n            \"netspyhunter-1.2.exe\",\n            \"netstat.exe\",\n            \"netutils.exe\",\n            \"nisserv.exe\",\n            \"nod32.exe\",\n            \"normist.exe\",\n            \"norton_internet_secu_3.0_407.exe\",\n            \"notstart.exe\",\n            \"npf40_tw_98_nt_me_2k.exe\",\n            \"npfmessenger.exe\",\n            \"npscheck.exe\",\n            \"npssvc.exe\",\n            \"nsched32.exe\",\n            \"nssys32.exe\",\n            \"nstask32.exe\",\n            \"nsupdate.exe\",\n            \"nt.exe\",\n            \"ntvdm.exe\",\n            \"ntxconfig.exe\",\n            \"nui.exe\",\n            \"nupgrade.exe\",\n            \"nvarch16.exe\",\n            \"nvc95.exe\",\n            \"nvsvc32.exe\",\n            \"nwinst4.exe\",\n            \"nwservice.exe\",\n            \"nwtool16.exe\",\n            \"ollydbg.exe\",\n            \"onsrvr.exe\",\n            \"optimize.exe\",\n            \"ostronet.exe\",\n            \"otfix.exe\",\n            \"outpostinstall.exe\",\n            \"outpostproinstall.exe\",\n            \"padmin.exe\",\n            \"panixk.exe\",\n            \"patch.exe\",\n            \"pavcl.exe\",\n            \"pavw.exe\",\n            \"pccwin98.exe\",\n            \"pcfwallicon.exe\",\n            \"pcip10117_0.exe\",\n            \"pcscan.exe\",\n            \"pdsetup.exe\",\n            \"periscope.exe\",\n            \"perswf.exe\",\n            \"pf2.exe\",\n            \"pfwadmin.exe\",\n            \"pgmonitr.exe\",\n            \"pingscan.exe\",\n            \"platin.exe\",\n            \"poproxy.exe\",\n            \"popscan.exe\",\n            \"portdetective.exe\",\n            \"portmonitor.exe\",\n            \"powerscan.exe\",\n            \"ppinupdt.exe\",\n            \"pptbc.exe\",\n            \"ppvstop.exe\",\n            \"prizesurfer.exe\",\n            \"prmt.exe\",\n            \"prmvr.exe\",\n            \"procdump.exe\",\n            \"processmonitor.exe\",\n            \"procexplorerv1.0.exe\",\n            \"programauditor.exe\",\n            \"proport.exe\",\n            \"protectx.exe\",\n            \"pspf.exe\",\n            \"purge.exe\",\n            \"qconsole.exe\",\n            \"qserver.exe\",\n            \"rav7.exe\",\n            \"rav7win.exe\",\n            \"rav8win32eng.exe\",\n            \"ray.exe\",\n            \"rb32.exe\",\n            \"rcsync.exe\",\n            \"realmon.exe\",\n            \"reged.exe\",\n            \"regedit.exe\",\n            \"regedt32.exe\",\n            \"rescue.exe\",\n            \"rescue32.exe\",\n            \"rrguard.exe\",\n            \"rshell.exe\",\n            \"rtvscn95.exe\",\n            \"rulaunch.exe\",\n            \"run32dll.exe\",\n            \"rundll.exe\",\n            \"rundll16.exe\",\n            \"ruxdll32.exe\",\n            \"safeweb.exe\",\n            \"sahagent.exe\",\n            \"save.exe\",\n            \"savenow.exe\",\n            \"sc.exe\",\n            \"scam32.exe\",\n            \"scan95.exe\",\n            \"scanpm.exe\",\n            \"scrscan.exe\",\n            \"serv95.exe\",\n            \"setup_flowprotector_us.exe\",\n            \"setupvameeval.exe\",\n            \"sfc.exe\",\n            \"sgssfw32.exe\",\n            \"sh.exe\",\n            \"shellspyinstall.exe\",\n            \"shn.exe\",\n            \"showbehind.exe\",\n            \"sms.exe\",\n            \"smss32.exe\",\n            \"soap.exe\",\n            \"sofi.exe\",\n            \"sperm.exe\",\n            \"spf.exe\",\n            \"spoler.exe\",\n            \"spoolcv.exe\",\n            \"spoolsv32.exe\",\n            \"spyxx.exe\",\n            \"srexe.exe\",\n            \"srng.exe\",\n            \"ss3edit.exe\",\n            \"ssg_4104.exe\",\n            \"ssgrate.exe\",\n            \"st2.exe\",\n            \"start.exe\",\n            \"stcloader.exe\",\n            \"supftrl.exe\",\n            \"support.exe\",\n            \"supporter5.exe\",\n            \"svchostc.exe\",\n            \"svchosts.exe\",\n            \"sweep95.exe\",\n            \"sweepnet.sweepsrv.sys.swnetsup.exe\",\n            \"symtray.exe\",\n            \"sysedit.exe\",\n            \"sysupd.exe\",\n            \"taskmg.exe\",\n            \"taskmo.exe\",\n            \"taumon.exe\",\n            \"tbscan.exe\",\n            \"tc.exe\",\n            \"tca.exe\",\n            \"tcm.exe\",\n            \"tds-3.exe\",\n            \"tds2-98.exe\",\n            \"tds2-nt.exe\",\n            \"teekids.exe\",\n            \"tfak.exe\",\n            \"tfak5.exe\",\n            \"tgbob.exe\",\n            \"titanin.exe\",\n            \"titaninxp.exe\",\n            \"tracert.exe\",\n            \"trickler.exe\",\n            \"trjsetup.exe\",\n            \"trojantrap3.exe\",\n            \"tsadbot.exe\",\n            \"tvmd.exe\",\n            \"tvtmd.exe\",\n            \"undoboot.exe\",\n            \"updat.exe\",\n            \"update.exe\",\n            \"upgrad.exe\",\n            \"utpost.exe\",\n            \"vbcons.exe\",\n            \"vbust.exe\",\n            \"vbwin9x.exe\",\n            \"vbwinntw.exe\",\n            \"vcsetup.exe\",\n            \"vet32.exe\",\n            \"vet95.exe\",\n            \"vettray.exe\",\n            \"vfsetup.exe\",\n            \"vir-help.exe\",\n            \"virusmdpersonalfirewall.exe\",\n            \"vnlan300.exe\",\n            \"vnpc3000.exe\",\n            \"vpc42.exe\",\n            \"vpfw30s.exe\",\n            \"vscan40.exe\",\n            \"vscenu6.02d30.exe\",\n            \"vsched.exe\",\n            \"vsecomr.exe\",\n            \"vsisetup.exe\",\n            \"vsmain.exe\",\n            \"vswin9xe.exe\",\n            \"vswinntse.exe\",\n            \"vswinperse.exe\",\n            \"w32dsm89.exe\",\n            \"w9x.exe\",\n            \"watchdog.exe\",\n            \"webdav.exe\",\n            \"wfindv32.exe\",\n            \"whoswatchingme.exe\",\n            \"wimmun32.exe\",\n            \"win-bugsfix.exe\",\n            \"win32.exe\",\n            \"win32us.exe\",\n            \"winactive.exe\",\n            \"window.exe\",\n            \"windows.exe\",\n            \"wininetd.exe\",\n            \"wininitx.exe\",\n            \"winlogin.exe\",\n            \"winmain.exe\",\n            \"winnet.exe\",\n            \"winppr32.exe\",\n            \"winrecon.exe\",\n            \"winservn.exe\",\n            \"winssk32.exe\",\n            \"winstart.exe\",\n            \"winstart001.exe\",\n            \"wintsk32.exe\",\n            \"winupdate.exe\",\n            \"wkufind.exe\",\n            \"wnad.exe\",\n            \"wnt.exe\",\n            \"wradmin.exe\",\n            \"wsbgate.exe\",\n            \"wupdater.exe\",\n            \"wupdt.exe\",\n            \"wyvernworksfirewall.exe\",\n            \"xpf202en.exe\",\n            \"zapsetup3001.exe\",\n            \"zatutor.exe\",\n            \"zonalm2601.exe\",\n            \"A2CMD.exe\",\n            \"ADVCHK.exe\",\n            \"AGB.exe\",\n            \"AKRNL.exe\",\n            \"AHPROCMONSERVER.exe\",\n            \"AIRDEFENSE.exe\",\n            \"ALERTSVC.exe\",\n            \"AVIRA.exe\",\n            \"AMON.exe\",\n            \"TROJAN.exe\",\n            \"AVZ.exe\",\n            \"ANTIVIR.exe\",\n            \"ARMOR2NET.exe\",\n            \"ASH.exeexe.exe\",\n            \"ASHENHCD.exe\",\n            \"ASHMAISV.exe\",\n            \"ASHPOPWZ.exe\",\n            \"ASHSERV.exe\",\n            \"ASHSIMPL.exe\",\n            \"ASHSKPCK.exe\",\n            \"ASHWEBSV.exe\",\n            \"ASWUPDSV.exe\",\n            \"ASWSCAN.exe\",\n            \"AVCIMAN.exe\",\n            \"AVENGINE.exe\",\n            \"AVESVC.exe\",\n            \"AVEVAL.exe\",\n            \"AVEVL32.exe\",\n            \"AVGAM.exe\",\n            \"AVGCC.exe\",\n            \"AVGCHSVX.exe\",\n            \"AVGCSRVX.exe\",\n            \"AVGNSX.exe\",\n            \"AVGCC32.exe\",\n            \"AVGCTRL.exe\",\n            \"AVGFWSRV.exe\",\n            \"AVGNTMGR.exe\",\n            \"AVGTRAY.exe\",\n            \"AVGUPSVC.exe\",\n            \"AVINITNT.exe\",\n            \"AVKSERV.exe\",\n            \"AVKSERVICE.exe\",\n            \"AVP32.exe\",\n            \"AVSERVER.exe\",\n            \"AVSCHED32.exe\",\n            \"AVSYNMGR.exe\",\n            \"AVWUPD32.exe\",\n            \"AVXMONITOR.exe\",\n            \"AVXQUAR.exe\",\n            \"BDSWITCH.exe\",\n            \"BLACKICE.exe\",\n            \"CAFIX.exe\",\n            \"CFP.exe\",\n            \"CFPCONFIG.exe\",\n            \"CFIAUDIT.exe\",\n            \"CLAMWIN.exe\",\n            \"CUREIT.exe\",\n            \"DEFWATCH.exe\",\n            \"DRVIRUS.exe\",\n            \"DRWADINS.exe\",\n            \"DRWEB.exe\",\n            \"DEFENDERDAEMON.exe\",\n            \"DWEBLLIO.exe\",\n            \"DWEBIO.exe\",\n            \"ESCANH95.exe\",\n            \"ESCANHNT.exe\",\n            \"EWIDOCTRL.exe\",\n            \"EZANTIVIRUSREGISTRATIONCHECK.exe\",\n            \"FILEMON.exe\",\n            \"FIREWALL.exe\",\n            \"FORTISCAN.exe\",\n            \"FPWIN.exe\",\n            \"FSBWSYS.exe\",\n            \"F-SCHED.exe\",\n            \"FSDFWD.exe\",\n            \"FSGK32.exe\",\n            \"FSGK32ST.exe\",\n            \"FSGUIEXE.exe\",\n            \"FSPEX.exe\",\n            \"GCASDTSERV.exe\",\n            \"GCASSERV.exe\",\n            \"GIANTANTISPYWARE.exe\",\n            \"GUARDGUI.exe\",\n            \"GUARDNT.exe\",\n            \"HREGMON.exe\",\n            \"HRRES.exe\",\n            \"HSOCKPE.exe\",\n            \"HUPDATE.exe\",\n            \"IAMSERV.exe\",\n            \"ICLOAD95.exe\",\n            \"ICLOADNT.exe\",\n            \"ICMON.exe\",\n            \"ICSSUPPNT.exe\",\n            \"ICSUPP95.exe\",\n            \"ICSUPPNT.exe\",\n            \"INETUPD.exe\",\n            \"INOCIT.exe\",\n            \"INORPC.exe\",\n            \"INORT.exe\",\n            \"INOTASK.exe\",\n            \"INOUPTNG.exe\",\n            \"IOMON98.exe\",\n            \"ISAFE.exe\",\n            \"ISATRAY.exe\",\n            \"KAV.exe\",\n            \"KAVMM.exe\",\n            \"KAVPFW.exe\",\n            \"KAVSTART.exe\",\n            \"KAVSVC.exe\",\n            \"KAVSVCUI.exe\",\n            \"KMAILMON.exe\",\n            \"MAMUTU.exe\",\n            \"MCAGENT.exe\",\n            \"MCREGWIZ.exe\",\n            \"MCUPDATE.exe\",\n            \"MINILOG.exe\",\n            \"MYAGTSVC.exe\",\n            \"MYAGTTRY.exe\",\n            \"NAVLU32.exe\",\n            \"NAVW32.exe\",\n            \"NEOWATCHLOG.exe\",\n            \"NEOWATCHTRAY.exe\",\n            \"NISSERV.exe\",\n            \"NOD32.exe\",\n            \"NORMIST.exe\",\n            \"NOTSTART.exe\",\n            \"NPAVTRAY.exe\",\n            \"NPFMSG.exe\",\n            \"NSCHED32.exe\",\n            \"NSMDTR.exe\",\n            \"NSSSERV.exe\",\n            \"NSSTRAY.exe\",\n            \"NTOS.exe\",\n            \"NTXCONFIG.exe\",\n            \"NUPGRADE.exe\",\n            \"NVCOD.exe\",\n            \"NVCTE.exe\",\n            \"NVCUT.exe\",\n            \"NWSERVICE.exe\",\n            \"OFCPFWSVC.exe\",\n            \"OPSSVC.exe\",\n            \"OP_MON.exe\",\n            \"PAVFIRES.exe\",\n            \"PAVFNSVR.exe\",\n            \"PAVKRE.exe\",\n            \"PAVPROT.exe\",\n            \"PAVPRSRV.exe\",\n            \"PAVSRV51.exe\",\n            \"PAVSS.exe\",\n            \"PCCGUIDE.exe\",\n            \"PCCIOMON.exe\",\n            \"PCCPFW.exe\",\n            \"PCCTLCOM.exe\",\n            \"PERTSK.exe\",\n            \"PERVAC.exe\",\n            \"PESTPATROL.exe\",\n            \"PNMSRV.exe\",\n            \"PREVSRV.exe\",\n            \"PREVX.exe\",\n            \"PSIMSVC.exe\",\n            \"QHONLINE.exe\",\n            \"QHONSVC.exe\",\n            \"QHWSCSVC.exe\",\n            \"QHSET.exe\",\n            \"RTVSCN95.exe\",\n            \"SALITY.exe\",\n            \"SAVADMINSERVICE.exe\",\n            \"SAVSCAN.exe\",\n            \"SCANNINGPROCESS.exe\",\n            \"SDRA64.exe\",\n            \"SDHELP.exe\",\n            \"SITECLI.exe\",\n            \"SPBBCSVC.exe\",\n            \"SPIDERCPL.exe\",\n            \"SPIDERML.exe\",\n            \"SPIDERUI.exe\",\n            \"SPYBOTSD.exe\",\n            \"SPYXX.exe\",\n            \"SS3EDIT.exe\",\n            \"STOPSIGNAV.exe\",\n            \"SWAGENT.exe\",\n            \"SWDOCTOR.exe\",\n            \"SWNETSUP.exe\",\n            \"SYMLCSVC.exe\",\n            \"SYMSPORT.exe\",\n            \"SYMWSC.exe\",\n            \"SYNMGR.exe\",\n            \"TAUMON.exe\",\n            \"TMNTSRV.exe\",\n            \"TMPROXY.exe\",\n            \"TNBUTIL.exe\",\n            \"VBA32ECM.exe\",\n            \"VBA32IFS.exe\",\n            \"VBA32LDR.exe\",\n            \"VBA32PP3.exe\",\n            \"VBSNTW.exe\",\n            \"VCRMON.exe\",\n            \"VRFWSVC.exe\",\n            \"VRRW32.exe\",\n            \"VSECOMR.exe\",\n            \"WATCHDOG.exe\",\n            \"WINSSNOTIFY.exe\",\n            \"XCOMMSVR.exe\",\n            \"ZLCLIENT.exe\",\n            \"navap.exe\",\n            \"sahagent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data文件系统实时监控\": {\n        \"processes\": [\n            \"avkwctl9.exe\",\n            \"AVKWCTL.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Anti-Virus\": {\n        \"processes\": [\n            \"SAVMAIN.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360保险箱\": {\n        \"processes\": [\n            \"safeboxTray.exe\",\n            \"360safebox.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data扫描器\": {\n        \"processes\": [\n            \"GDScan.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data杀毒代理\": {\n        \"processes\": [\n            \"AVKProxy.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"G Data备份服务\": {\n        \"processes\": [\n            \"AVKBackupService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"亚信安全服务器深度安全防护系统\": {\n        \"processes\": [\n            \"Notifier.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云盾\": {\n        \"processes\": [\n            \"AliYunDun.exe\",\n            \"AliYunDunUpdate.exe\",\n            \"aliyun_assist_service.exe\",\n            \"/usr/local/aegis/aegis_client/\"\n        ],\n        \"url\": \"\"\n    },\n    \"腾讯云安全\": {\n        \"processes\": [\n            \"BaradAgent.exe\",\n            \"sgagent.exe\",\n            \"YDService.exe\",\n            \"YDLive.exe\",\n            \"YDEdr.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360主机卫士Web\": {\n        \"processes\": [\n            \"360WebSafe.exe\",\n            \"QHSrv.exe\",\n            \"QHWebshellGuard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"网防G01\": {\n        \"processes\": [\n            \"gov_defence_service.exe\",\n            \"gov_defence_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"云锁客户端\": {\n        \"processes\": [\n            \"PC.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Symantec Shared诺顿邮件防火墙软件\": {\n        \"processes\": [\n            \"SNDSrvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"U盘杀毒专家\": {\n        \"processes\": [\n            \"USBKiller.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天擎EDRAgent\": {\n        \"processes\": [\n            \"360EntClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360(奇安信)天擎\": {\n        \"processes\": [\n            \"360EntMisc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云-云盾\": {\n        \"processes\": [\n            \"alisecguard.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos AutoUpdate Service\": {\n        \"processes\": [\n            \"ALsvc.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"阿里云监控\": {\n        \"processes\": [\n            \"CmsGoAgent.windows-amd64.\"\n        ],\n        \"url\": \"\"\n    },\n    \"深信服EDRAgent\": {\n        \"processes\": [\n            \"edr_agent.exe\",\n            \"edr_monitor.exe\",\n            \"edr_sec_plan.exe\"\n        ],\n        \"url\": \"https://edr.sangfor.com.cn\"\n    },\n    \"戎码翼龙 NG-EDR\": {\n        \"processes\": [\n            \"rm_service.exe\",\n            \"rm_live.exe\",\n            \"rm_tray.exe\",\n            \"rm_hips.exe\"\n        ],\n        \"url\": \"https://www.rongma.com\"\n    },\n    \"启明星辰天珣EDRAgent\": {\n        \"processes\": [\n            \"ESAV.exe\",\n            \"ESCCControl.exe\",\n            \"ESCC.exe\",\n            \"ESCCIndex.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"蓝鲸Agent\": {\n        \"processes\": [\n            \"gse_win_agent.exe\",\n            \"gse_win_daemon.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"联想电脑管家\": {\n        \"processes\": [\n            \"LAVService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Agent\": {\n        \"processes\": [\n            \"McsAgent.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos MCS Client\": {\n        \"processes\": [\n            \"McsClient.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"360TotalSecurity(360国际版)\": {\n        \"processes\": [\n            \"QHSafeMain.exe\",\n            \"QHSafeTray.exe\",\n            \"QHWatchdog.exe\",\n            \"QHActiveDefense.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Device Control Service\": {\n        \"processes\": [\n            \"sdcservice.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Endpoint Defense Service\": {\n        \"processes\": [\n            \"SEDService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Windows Defender SmartScreen\": {\n        \"processes\": [\n            \"smartscreen.exe\"\n        ],\n        \"url\": \"https://learn.microsoft.com/zh-cn/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/\"\n    },\n    \"Sophos Clean Service\": {\n        \"processes\": [\n            \"SophosCleanM64.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos FIM\": {\n        \"processes\": [\n            \"SophosFIMService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos System Protection Service\": {\n        \"processes\": [\n            \"SSPService.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"Sophos Web Control Service\": {\n        \"processes\": [\n            \"swc_service.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天眼云镜\": {\n        \"processes\": [\n            \"TitanAgent.exe\",\n            \"TitanMonitor.exe\"\n        ],\n        \"url\": \"\"\n    },\n    \"天融信终端防御\": {\n        \"processes\": [\n            \"TopsecMain.exe\",\n            \"TopsecTray.exe\"\n        ],\n\n<!-- File: SKILL.md (Tokens: ~3886 | Category: anthropic-skill) -->\n---\nname: fscan-agent\ndescription: 使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。\nargument-hint: <目标IP/网段> [附加参数]\nallowed-tools: Bash, Read, Agent\n---\n\n# Fscan AI Agent Skill\n\n## 工具概述\n\nFscan 是一款内网综合扫描工具，功能包括：\n- 主机存活探测（ICMP / TCP）\n- 端口扫描与服务识别\n- 漏洞检测（MS17-010、Redis 未授权等）\n- 弱口令爆破（SSH、SMB、MySQL、MSSQL、FTP、RDP 等）\n- Web 指纹识别与 POC 扫描\n- NetBIOS / SMB 信息收集\n- 本地信息收集（杀软检测、系统信息等）\n\n二进制路径：当前项目编译产物 `fscan_cli`，或系统 PATH 中的 `fscan`。\n\n## 调用格式\n\n```bash\n# AI agent 标准用法：NDJSON 输出，无人类日志干扰\nfscan -h <目标> -silent [其他参数]\n\n# 解析输出\nfscan -h 192.168.1.0/24 -silent | jq 'select(.type==\"VULN\")'\n```\n\n## 核心参数\n\n### 目标指定\n\n| 参数 | 说明 | 示例 |\n|------|------|------|\n| `-h` | 目标主机（IP / CIDR / 范围） | `-h 192.168.1.0/24` `-h 10.0.0.1-10.0.0.100` |\n| `-hf` | 从文件读取目标 | `-hf targets.txt` |\n| `-p` | 指定端口（逗号/范围） | `-p 22,80,443,445,3306` `-p 1-1000` |\n| `-ep` | 排除端口 | `-ep 25,110` |\n| `-eh` | 排除主机 | `-eh 192.168.1.1` |\n| `-u` | 指定 URL（Web 扫描） | `-u https://example.com` |\n| `-uf` | URL 文件 | `-uf urls.txt` |\n\n### 扫描控制\n\n| 参数 | 说明 | 默认值 |\n|------|------|--------|\n| `-m` | 扫描模式 | `all` |\n| `-t` | 端口扫描线程数 | `600` |\n| `-mt` | 模块线程数 | `20` |\n| `-time` | 连接超时（秒） | `3` |\n| `-gt` | 全局超时（秒，0 表示不限制） | `0` |\n| `-np` | 跳过存活检测 | `false` |\n| `-ntp` | 禁用 TCP 补充探测 | `false` |\n| `-ao` | 仅存活检测 | `false` |\n| `-nobr` | 禁用暴力破解 | `false` |\n| `-full` | 全量 POC 扫描 | `false` |\n| `-max-retries` | 最大重试次数 | `1` |\n\n### 认证\n\n| 参数 | 说明 |\n|------|------|\n| `-user` | 用户名 |\n| `-pwd` | 密码 |\n| `-usera` | 追加用户名 |\n| `-pwda` | 追加密码，支持逗号或空格分隔多个值 |\n| `-userf` | 用户名字典文件 |\n| `-pwdf` | 密码字典文件 |\n| `-domain` | 域名（SMB/WMI） |\n| `-sshkey` | SSH 私钥文件 |\n| `-hash` / `-hashf` | NTLM Hash / Hash 文件 |\n\n### 代理\n\n| 参数 | 说明 |\n|------|------|\n| `-socks5` | SOCKS5 代理 (`127.0.0.1:1080`) |\n| `-proxy` | HTTP 代理 (`http://127.0.0.1:8080`) |\n| `-iface` | 指定本地网卡 IP（VPN 场景） |\n\n### 输出\n\n| 参数 | 说明 |\n|------|------|\n| `-silent` | 静默模式：stdout 仅输出 NDJSON |\n| `-o` | 输出文件路径（默认 `result.txt`） |\n| `-f` | 输出格式：`txt` / `json` / `csv` |\n| `-no` | 禁用文件保存 |\n| `-debug` | 调试模式：日志写入 `fscan_debug.log` |\n| `-log` | 日志级别（`debug` / `info` / `base` / `error`） |\n\n### 扫描模式 `-m` 的取值\n\n| 值 | 说明 |\n|------|------|\n| `all` | 全部扫描（默认） |\n| `icmp` | 仅 ICMP 存活检测 |\n| 插件名 | 仅运行指定插件（如 `ssh`、`smb`、`ms17010`、`webtitle`） |\n\n## 服务插件列表\n\n| 插件 | 默认端口 | 功能 |\n|------|----------|------|\n| `ftp` | 21 | FTP 弱口令 |\n| `ssh` | 22 | SSH 弱口令 |\n| `telnet` | 23 | Telnet 弱口令 |\n| `smtp` | 25 | SMTP 弱口令 |\n| `findnet` | 135 | RPC 网络信息发现（NetInfo） |\n| `netbios` | 139 | NetBIOS 信息收集 |\n| `smb` | 445 | SMB 弱口令 |\n| `ms17010` | 445 | MS17-010 永恒之蓝检测 |\n| `ldap` | 389 | LDAP 弱口令 |\n| `mssql` | 1433 | MSSQL 弱口令 |\n| `oracle` | 1521 | Oracle 弱口令 |\n| `mysql` | 3306 | MySQL 弱口令 |\n| `rdp` | 3389 | RDP 弱口令 + 系统信息 |\n| `postgresql` | 5432 | PostgreSQL 弱口令 |\n| `vnc` | 5900 | VNC 弱口令 |\n| `redis` | 6379 | Redis 未授权 + 弱口令 |\n| `elasticsearch` | 9200 | ES 未授权 |\n| `mongodb` | 27017 | MongoDB 未授权 + 弱口令 |\n| `memcached` | 11211 | Memcached 未授权 |\n| `kafka` | 9092 | Kafka 未授权 |\n| `activemq` | 61616 | ActiveMQ 弱口令 |\n| `rabbitmq` | 5672 | RabbitMQ 弱口令 |\n| `cassandra` | 9042 | Cassandra 弱口令 |\n| `neo4j` | 7687 | Neo4j 弱口令 |\n| `rsync` | 873 | Rsync 未授权 |\n| `webtitle` | 80/443 | Web 标题 + 指纹识别 |\n| `webpoc` | 80/443 | Web 漏洞 POC |\n\n## 本地插件（`-local`）\n\n```bash\nfscan -local avdetect    # 杀软检测\nfscan -local systeminfo  # 系统信息收集\nfscan -local envinfo     # 环境变量信息\nfscan -local dcinfo      # 域控信息\nfscan -local fileinfo    # 敏感文件搜索\n```\n\n## NDJSON 输出 Schema（`-silent` 模式）\n\n每行一个 JSON 对象，所有字段定义：\n\n| 字段 | 类型 | 出现条件 | 说明 |\n|------|------|----------|------|\n| `type` | string | 必有 | `HOST` / `PORT` / `SERVICE` / `VULN` |\n| `target` | string | 必有 | 原始目标 `host` 或 `host:port` |\n| `status` | string | 必有 | 状态描述 |\n| `host` | string | 必有 | IP 地址 |\n| `port` | int | PORT/SERVICE/VULN | 端口号 |\n| `service` | string | SERVICE/VULN | 服务名（ssh, smb, http 等） |\n| `protocol` | string | HOST/SERVICE | 协议（ICMP, TCP, http, https） |\n| `banner` | string | SERVICE | 服务 Banner |\n| `title` | string | SERVICE (web) | 网页标题 |\n| `url` | string | SERVICE (web) | 完整 URL |\n| `vulnerability` | string | VULN | 漏洞名称 |\n| `username` | string | VULN (弱口令) | 用户名 |\n| `password` | string | VULN (弱口令) | 密码 |\n| `plugin` | string | SERVICE/VULN | 产生结果的插件名 |\n| `version` | string | SERVICE | 服务版本号 |\n| `os` | string | SERVICE | 操作系统信息 |\n\n### 输出示例\n\n```jsonl\n{\"type\":\"HOST\",\"target\":\"192.168.1.5\",\"status\":\"alive\",\"host\":\"192.168.1.5\",\"protocol\":\"ICMP\"}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":22}\n{\"type\":\"PORT\",\"target\":\"192.168.1.5\",\"status\":\"open\",\"host\":\"192.168.1.5\",\"port\":445}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:22\",\"status\":\"identified\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"banner\":\"SSH-2.0-OpenSSH_8.9p1\",\"version\":\"8.9p1\",\"plugin\":\"portscan\"}\n{\"type\":\"SERVICE\",\"target\":\"192.168.1.5:80\",\"status\":\"web\",\"host\":\"192.168.1.5\",\"port\":80,\"service\":\"http\",\"protocol\":\"http\",\"url\":\"http://192.168.1.5:80\",\"title\":\"Welcome\",\"plugin\":\"webtitle\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:445\",\"status\":\"MS17-010 (Windows Server 2012 R2 Standard 9600)\",\"host\":\"192.168.1.5\",\"port\":445,\"vulnerability\":\"MS17-010\",\"service\":\"smb\",\"plugin\":\"ms17010\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:22\",\"status\":\"weak_credential: root:123456\",\"host\":\"192.168.1.5\",\"port\":22,\"service\":\"ssh\",\"username\":\"root\",\"password\":\"123456\",\"plugin\":\"ssh\"}\n{\"type\":\"VULN\",\"target\":\"192.168.1.5:6379\",\"status\":\"Redis unauthorized\",\"host\":\"192.168.1.5\",\"port\":6379,\"vulnerability\":\"Redis unauthorized access\",\"service\":\"redis\",\"plugin\":\"redis\"}\n```\n\n### 结果产出顺序\n\n1. `HOST` — 存活探测阶段\n2. `PORT` — 端口扫描阶段（与 SERVICE 可能交错）\n3. `SERVICE` — 服务识别阶段\n4. `VULN` — 漏洞/弱口令检测阶段\n\n同一 `host:port` 可产生多条结果（PORT + SERVICE + VULN）。\n\n## 常用场景参数组合\n\n### 全网段快速扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent\n```\n\n### 跳过存活检测直接扫端口（目标明确时）\n\n```bash\nfscan -h 192.168.1.0/24 -silent -np\n```\n\n### 指定端口精确扫描\n\n```bash\nfscan -h 10.0.0.0/24 -silent -p 22,80,443,445,3389,3306,6379\n```\n\n### 仅存活探测\n\n```bash\nfscan -h 172.16.0.0/16 -silent -m icmp\n```\n\n### 低速隐蔽扫描\n\n```bash\nfscan -h 192.168.1.0/24 -silent -t 30 -time 5\n```\n\n### 通过 SOCKS5 代理扫描内网\n\n```bash\nfscan -h 10.0.0.0/24 -silent -socks5 127.0.0.1:1080\n```\n\n### 仅做弱口令检测\n\n```bash\nfscan -h 192.168.1.10 -silent -m ssh -user root -pwdf /path/to/passwords.txt\n```\n\n### Web 目标扫描\n\n```bash\nfscan -u https://target.com -silent -full\n```\n\n### 多目标文件批量扫描\n\n```bash\nfscan -hf targets.txt -silent -o results.json -f json\n```\n\n### 带调试日志的排障扫描\n\n```bash\n# NDJSON 到 stdout，debug 日志到文件，互不干扰\nfscan -h 192.168.1.0/24 -silent -debug\n# 事后查看：cat fscan_debug.log\n```\n\n## AI Agent 结果处理\n\n### Python 管道消费\n\n```python\nimport json, subprocess\n\nproc = subprocess.Popen(\n    [\"fscan\", \"-h\", \"192.168.1.0/24\", \"-silent\"],\n    stdout=subprocess.PIPE, text=True\n)\n\nhosts, services, vulns = [], [], []\nfor line in proc.stdout:\n    r = json.loads(line)\n    if r[\"type\"] == \"HOST\":\n        hosts.append(r[\"host\"])\n    elif r[\"type\"] == \"SERVICE\":\n        services.append(r)\n    elif r[\"type\"] == \"VULN\":\n        vulns.append(r)\n\nproc.wait()\n```\n\n### jq 过滤\n\n```bash\n# 提取所有弱口令\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.username != null) | \"\\(.host):\\(.port) \\(.service) \\(.username):\\(.password)\"'\n\n# 提取所有漏洞\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"VULN\") | \"\\(.host):\\(.port) \\(.vulnerability)\"'\n\n# 提取 Web 服务\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.url != null) | \"\\(.url) \\(.title)\"'\n\n# 统计开放端口\nfscan -h 10.0.0.0/24 -silent | jq -r 'select(.type==\"PORT\") | .port' | sort -n | uniq -c | sort -rn\n```\n\n## 注意事项\n\n- `-silent` 抑制所有人类可读日志，stdout 仅输出 NDJSON\n- 空字段不出现在 JSON 中（`omitempty`）\n- 进程退出码 `0` 正常完成，非 `0` 表示参数错误或初始化失败\n- `-silent` 和 `-debug` 可同时使用，互不干扰\n- SOCKS5 代理下 fscan 信任协议层连接结果，不做额外深度验证\n- 扫描大网段时线程数会自动调整，资源耗尽时自适应降级\n- 默认超时 3 秒，防火墙 drop 的端口会静默超时，不计入失败率\n\n<!-- File: plugins/README.md (Tokens: ~2073 | Category: plugin-manifest) -->\n# FScan 插件开发规范\n\n## 概述\n\nFScan 采用简化的单文件插件架构，每个插件一个 `.go` 文件，消除了过度设计的多文件结构。\n\n\n1. **简洁至上**：消除所有不必要的抽象层\n2. **直击本质**：专注于解决实际问题，不为架构而架构  \n3. **向后兼容**：不破坏用户接口和现有功能\n4. **消除特殊情况**：统一处理逻辑，减少 if/else 分支\n\n## 插件架构\n\n### 核心接口\n\n```go\n// Plugin 插件接口 - 只保留必要的方法\ntype Plugin interface {\n    GetName() string                                        // 插件名称\n    GetPorts() []int                                       // 支持的端口\n    Scan(ctx context.Context, info *common.HostInfo) *ScanResult  // 扫描功能\n}\n\n// 可选接口：如果插件支持利用功能\ntype Exploiter interface {\n    Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult\n}\n```\n\n### 数据结构\n\n```go\n// ScanResult 扫描结果 - 删除所有冗余字段\ntype ScanResult struct {\n    Success  bool   // 扫描是否成功\n    Service  string // 服务类型\n    Username string // 发现的用户名（弱密码）\n    Password string // 发现的密码（弱密码）  \n    Banner   string // 服务版本信息\n    Error    error  // 错误信息（如果失败）\n}\n\n// ExploitResult 利用结果（仅有利用功能的插件需要）\ntype ExploitResult struct {\n    Success bool   // 利用是否成功\n    Output  string // 命令执行输出\n    Error   error  // 错误信息\n}\n\n// Credential 凭据结构\ntype Credential struct {\n    Username string\n    Password string\n    KeyData  []byte // SSH私钥等\n}\n```\n\n## 插件开发模板\n\n### 1. 纯扫描插件（如MySQL）\n\n```go\npackage plugins\n\nimport (\n    \"context\"\n    \"fmt\"\n    // 其他必要导入\n)\n\n// PluginName服务扫描插件\ntype PluginNamePlugin struct {\n    name  string\n    ports []int\n}\n\n// 构造函数\nfunc NewPluginNamePlugin() *PluginNamePlugin {\n    return &PluginNamePlugin{\n        name:  \"plugin_name\",\n        ports: []int{default_port},\n    }\n}\n\n// 实现Plugin接口\nfunc (p *PluginNamePlugin) GetName() string { return p.name }\nfunc (p *PluginNamePlugin) GetPorts() []int { return p.ports }\n\nfunc (p *PluginNamePlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 如果禁用暴力破解，只做服务识别\n    if common.DisableBrute {\n        return p.identifyService(info)\n    }\n\n    // 生成测试凭据\n    credentials := GenerateCredentials(\"plugin_name\")\n    \n    // 逐个测试凭据\n    for _, cred := range credentials {\n        select {\n        case <-ctx.Done():\n            return &ScanResult{Success: false, Error: ctx.Err()}\n        default:\n        }\n\n        if p.testCredential(ctx, info, cred) {\n            return &ScanResult{\n                Success:  true,\n                Service:  \"plugin_name\",\n                Username: cred.Username,\n                Password: cred.Password,\n            }\n        }\n    }\n\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 核心认证逻辑\nfunc (p *PluginNamePlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool {\n    // 实现具体的认证测试逻辑\n    return false\n}\n\n// 服务识别（-nobr模式）\nfunc (p *PluginNamePlugin) identifyService(info *common.HostInfo) *ScanResult {\n    // 实现服务识别逻辑\n    return &ScanResult{Success: false, Service: \"plugin_name\"}\n}\n\n// 自动注册\nfunc init() {\n    RegisterPlugin(\"plugin_name\", func() Plugin {\n        return NewPluginNamePlugin()\n    })\n}\n```\n\n### 2. 带利用功能的插件（如SSH）\n\n```go\npackage plugins\n\n// SSH插件结构\ntype SSHPlugin struct {\n    name  string\n    ports []int\n}\n\n// 同时实现Plugin和Exploiter接口\nfunc (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {\n    // 扫描逻辑（同上）\n}\n\nfunc (p *SSHPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult {\n    // 建立SSH连接\n    client, err := p.connectSSH(info, creds)\n    if err != nil {\n        return &ExploitResult{Success: false, Error: err}\n    }\n    defer client.Close()\n\n    // 执行命令或其他利用操作\n    output, err := p.executeCommand(client, \"whoami\")\n    return &ExploitResult{\n        Success: err == nil,\n        Output:  output,\n        Error:   err,\n    }\n}\n\n// 辅助方法\nfunc (p *SSHPlugin) connectSSH(info *common.HostInfo, creds Credential) (*ssh.Client, error) {\n    // SSH连接实现\n}\n\nfunc (p *SSHPlugin) executeCommand(client *ssh.Client, cmd string) (string, error) {\n    // 命令执行实现\n}\n```\n\n## 开发规范\n\n### 文件组织\n\n```\nplugins/\n├── base.go           # 核心接口和注册系统\n├── mysql.go          # MySQL插件\n├── ssh.go            # SSH插件  \n├── redis.go          # Redis插件\n└── README.md         # 开发文档（本文件）\n```\n\n### 命名规范\n\n- **插件文件**：`{service_name}.go`\n- **插件结构体**：`{ServiceName}Plugin`\n- **构造函数**：`New{ServiceName}Plugin()`\n- **插件名称**：小写，与文件名一致\n\n### 代码规范\n\n1. **错误处理**：始终使用Context进行超时控制\n2. **日志输出**：成功时使用 `common.LogSuccess`，调试用 `common.LogDebug`\n3. **凭据生成**：使用 `GenerateCredentials(service_name)` 生成测试凭据\n4. **资源管理**：及时关闭连接，使用 defer 确保清理\n\n### 测试要求\n\n每个插件必须支持：\n\n1. **暴力破解模式**：`common.DisableBrute = false`\n2. **服务识别模式**：`common.DisableBrute = true`\n3. **Context超时处理**：正确响应 `ctx.Done()`\n4. **代理支持**：如果 `common.Socks5Proxy` 不为空\n\n## 迁移指南\n\n### 从三文件架构迁移\n\n1. **提取核心逻辑**：从 connector.go 提取认证逻辑\n2. **合并实现**：将 plugin.go 中的组装逻辑内联\n3. **删除垃圾**：删除空的 exploiter.go\n4. **简化数据结构**：只保留必要的字段\n\n### 从Legacy插件迁移\n\n1. **保留核心逻辑**：复制扫描和认证的核心算法\n2. **标准化接口**：实现统一的Plugin接口  \n3. **移除全局依赖**：通过返回值而不是全局变量传递结果\n4. **统一日志**：使用统一的日志接口\n\n## 性能优化\n\n1. **连接复用**：在同一次扫描中复用连接\n2. **内存管理**：及时释放不需要的资源\n3. **并发控制**：通过Context控制并发度\n4. **超时设置**：合理设置各阶段超时时间\n\n## 示例\n\n参考 `mysql.go` 作为标准的纯扫描插件实现\n参考 `ssh.go` 作为带利用功能的插件实现\n\n---\n\n**记住：好的代码不是写出来的，是重构出来的。消除所有不必要的复杂性，直击问题本质。**\n\n<!-- File: plugins/services/README.md (Tokens: ~552 | Category: plugin-manifest) -->\n# 服务扫描插件目录\n\n本目录包含所有服务扫描插件，采用简化的单文件插件架构。\n\n## 已实现插件\n\n### 数据库服务\n- `mysql.go` - MySQL数据库扫描\n- `postgresql.go` - PostgreSQL数据库扫描  \n- `redis.go` - Redis内存数据库扫描\n- `mongodb.go` - MongoDB文档数据库扫描\n- `mssql.go` - Microsoft SQL Server扫描\n- `oracle.go` - Oracle数据库扫描\n- `memcached.go` - Memcached缓存扫描\n- `neo4j.go` - Neo4j图数据库扫描\n\n### 消息队列服务\n- `rabbitmq.go` - RabbitMQ消息队列扫描\n- `activemq.go` - ActiveMQ消息队列扫描\n- `kafka.go` - Apache Kafka扫描\n\n### 网络服务\n- `ssh.go` - SSH远程登录服务扫描\n- `ftp.go` - FTP文件传输服务扫描\n- `telnet.go` - Telnet远程终端服务扫描\n- `smtp.go` - SMTP邮件服务扫描\n- `snmp.go` - SNMP网络管理协议扫描\n- `ldap.go` - LDAP目录服务扫描\n- `rsync.go` - Rsync文件同步服务扫描\n\n### Windows服务\n- `findnet.go` - Windows网络发现插件 (RPC端点映射)\n- `smbinfo.go` - SMB协议信息收集插件\n\n### 其他服务\n- `vnc.go` - VNC远程桌面服务扫描\n- `cassandra.go` - Apache Cassandra数据库扫描\n\n## 插件特性\n\n每个插件都包含：\n- ✅ 服务识别功能\n- ✅ 弱密码检测功能\n- ✅ 完整的利用功能\n- ✅ 错误处理和超时控制\n- ✅ 统一的结果输出格式\n\n## 开发规范\n\n所有插件都遵循 `../README.md` 中定义的开发规范。\n</yakaai_skills>"}