diff --git a/DuckMemoryScan/main.cpp b/DuckMemoryScan/main.cpp
index c07a5ff..37eaa1c 100644
--- a/DuckMemoryScan/main.cpp
+++ b/DuckMemoryScan/main.cpp
@@ -232,7 +232,7 @@ void ThreadStackWalk() {
 		CloseHandle(hThreadSnap);
 	}
 }
-void WalkProcessMoudle(DWORD pID,HANDLE pHandle,WCHAR* pMoudleName) {
+void WalkProcessMoudle(DWORD pID,HANDLE pHandle,WCHAR* pMoudleName,BOOL pCheckMoudle) {
 
 	MODULEENTRY32 moduleEntry;
 	HANDLE handle = NULL;
@@ -246,6 +246,13 @@ void WalkProcessMoudle(DWORD pID,HANDLE pHandle,WCHAR* pMoudleName) {
 			return;
 		}
 		do {
+			if (pCheckMoudle) {
+				CdigitalSig DigitalSig(moduleEntry.szExePath);
+				DWORD dDigitalState = DigitalSig.GetDigitalState();
+				if (dDigitalState != DIGITAL_SIGSTATE_VALID) {
+					printf("\t => [模块扫描] 检测到可疑模块(也许是误报) 路径 %ws 进程名字 %ws pid %d \n", moduleEntry.szExePath, pMoudleName, pID);
+				}
+			}
 			DWORD64 ReadNum = 0;
 			if (ReadProcessMemory(pHandle, moduleEntry.modBaseAddr, AllocBuff, 0x200, &ReadNum)) {
 				if (AllocBuff[0] == 'M' && AllocBuff[1] == 'Z') {
@@ -286,7 +293,6 @@ void ProcessStackWalk() {
 		//打印进程名和进程ID
 		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pe32.th32ProcessID);
 		if (hProcess) {
-			WalkProcessMoudle(pe32.th32ProcessID, hProcess, pe32.szExeFile);
 			WCHAR szImagePath[MAX_PATH];
 			WCHAR pszFullPath[MAX_PATH];
 			if (GetProcessImageFileName(hProcess, szImagePath, MAX_PATH))
@@ -298,6 +304,8 @@ void ProcessStackWalk() {
 					if (dDigitalState == DIGITAL_SIGSTATE_REVOKED || dDigitalState == DIGITAL_SIGSTATE_EXPIRE) {
 						printf("\t => [进程扫描] 检测到可疑签名进程 路径 %ws static %d \n", pszFullPath, dDigitalState);
 					}
+					WalkProcessMoudle(pe32.th32ProcessID, hProcess, pe32.szExeFile, dDigitalState == DIGITAL_SIGSTATE_VALID);
+
 				}
 			}
 			CloseHandle(hProcess);
diff --git a/README.md b/README.md
index 6e12558..1fa544b 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
 # DuckMemoryScan
 涓�涓畝鍗曞鎵炬棤鏂囦欢钀藉湴鍚庨棬鐨勫伐鍏�,鐢県uoji鑺变簡1澶╃紪鍐�,缂栧啓鏃堕棿2021-02-24
+!!!鏈▼搴忛渶瑕�64浣嶇紪璇戞墠鑳藉洖婧痻64鐨勭▼搴忓爢鏍�,璇峰嬁鎵ц32浣嶇紪璇�!!!
 
 # 杩愯鎴浘
 ![image](https://raw.githubusercontent.com/huoji120/DuckMemoryScan/master/%E6%BC%94%E7%A4%BA%E5%9B%BE%E7%89%87.png)
@@ -10,7 +11,7 @@
 3. 鍙枒杩涚▼妫�娴�(涓昏閽堝鏈夐�冮伩鎬ц川鐨勮繘绋媅濡傝繃鏈熺鍚嶄笌澶氬悇鍙墽琛屽尯娈礭)
 4. 鏃犳枃浠惰惤鍦版湪椹娴�(妫�娴嬫墍鏈夊凡鐭ュ唴瀛樺姞杞芥湪椹�)
 5. 绠�鏄搑ootkit妫�娴�(妫�娴嬭瘉涔﹁繃鏈�/鎷︽埅璇诲彇/璇佷功鏃犳晥鐨勯┍鍔�)
-
+6. 妫�娴嬪紓甯告ā鍧�,妫�娴嬬粷澶ч儴鍒嗗"iis鍔寔"鐨勫悗闂�(2021骞�2鏈�26鏃ユ柊澧�)
 # 鍏嶆潃鏈ㄩ┈妫�娴嬪師鐞�:
 鎵�鏈夋墍璋撶殑鍐呭瓨鍏嶆潃鍚庨棬澶ч儴鍒嗗熀浜�"VirtualAlloc"鍑芥暟鐢宠鍐呭瓨 涔嬪悗閫氳繃鍚勭鑾悕鍏跺鐨剎or鐢氳嚦鏄痑es鍔犲瘑鍘绘贩娣唖hellcode杈惧埌"鍏嶆潃"鏁堟灉.
 鏈伐鍏烽�氳繃绾跨▼鍫嗘爤鍥炴函鏂规硶(StackWalkEx鍑芥暟)閬嶅巻绾跨▼,瀵绘壘绯荤粺涓湪VirtualAlloc鍖哄煙鎵ц浠ｇ爜鐨勫尯鍩�,浠庤�屾彧鍑�"鍏嶆潃鏈ㄩ┈"
@@ -23,6 +24,9 @@
 2. 绾跨▼鎸囧悜涓�涓狽OIMAGE鍐呭瓨
 鏈伐鍏峰皢浼氶�氳繃绗竴绉嶇壒寰佹娴嬪嚭鎵�鏈�"鏃犳枃浠惰惤鍦版湪椹�"
 
+# 寮傚父妯″潡妫�娴嬪師鐞�
+鏈伐鍏峰皢浼氭壂鎻忔墍鏈夊甫绛惧悕绋嬪簭鐨勬ā鍧楀垪琛ㄥ苟涓旀娴嬪叾涓ā鍧楁槸鍚﹀瓨鍦ㄧ鍚�,濡傛灉涓嶅瓨鍦ㄥ垯鍙戝嚭鎻愮ず.鏈娴嬪瓨鍦ㄨ緝澶氳鎶�,浣嗗皢浼氭娴嬪埌绫讳技IIS鍔寔鐨勭壒娈婃ā鍧�
+
 # 浣跨敤鏂瑰紡
 缂栬瘧 杩愯 寰楀埌淇℃伅鍒楄〃