diff --git a/README.md b/README.md
index bcbf69c..7adf0b8 100644
--- a/README.md
+++ b/README.md
@@ -16,15 +16,20 @@
     
 - [Malware analysis method(reference&memo)](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md)
   - [Tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#tools)
+    - [VM/OS](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#osvm)
     - [Static Analysis and Debug tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#static-analysis-and-debug-tools)
     - [Tracer](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#tracer)
     - [Instrumentation](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#instrumentation)
     - [Traffic Analysis tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#traffic-analysis-tools)
     - [Forensic](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#forensic)
+    - [Threat hunting](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#threat-hunting)
+    - [.NET analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#net-analysis)
+    - [Utilities](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#utilities)
     - [Online Sandbox](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#online-sandbox)
     - [Unpacker/Decryptor/Decoder/Extractor/Memory Scanner](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#unpackerdecryptordecoderextractormemory-scanner)
   - [Doc Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#doc-analysis)
   - [C2 Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#c2-analysis)
+    - [Emotet](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#emotet)
     - [Ursnif](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#ursnif)
   - [Binary Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#binary-analysis)
 - [Emotet](https://github.com/mether049/malware/tree/master/Emotet)