Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

RE: Looking for a tool
From: "Jeremiah Cornelius" <jeremiah () nur net>
Date: Tue, 2 Mar 2004 08:17:00 -0800

Arne Vidstrom has something useful here:
http://ntsecurity.nu/toolbox/

 
ListModules <http://ntsecurity.nu/toolbox/listmodules/>  

ListModules lists the modules (EXE's and DLL's) that are loaded into a
process. This can be useful in a forensic investigation. 

        >  OS: Windows NT 4.0 / 2000 / XP
        >  Version: 1.1
        >  File Size: 28 kb
        >  First release: 2002.02.16



begin 666 smime.p7s
M,( &"2J&2(;W#0$'`J" ,( "`0$Q"S )! () 4K#@,"&@4`,( &"2J&2(;W#0$'
M`0``H((,03""`?HP@@%C`@(!HS -! () DJADB&]PT!`00%`#!%,0LP"08#500&
M$P)54S$8,!8&`U4$"A,/1U1%($-O<G!O<F%T:6]N,1PP&@8#500#$Q-'5$4@
M0WEB97)4<G5S="!2;V]T,!X7#3DV,#(R,S(S,#$P,%H7#3 V,#(R,S(S-3DP
M,%HP13$+, D&`U4$!A,"55,Q&# 6! () -5! H3#T=412!#;W)P;W)A=&EO;C$<
M,!H&`U4$`Q,31U1%($-Y8F5R5')U<W0 () 4F]O=#"!GS -! () DJADB&]PT!`0$%
M``.!C0`P () 8D"@8$`N.9/NMN8?'%\KT2WTP]&V63ED\%"CL>Z28TU+7KGB[WE
M!3%9QK$O"@S[GZ<_H () EFA%8>-RD;A^E^#,J:GZ5_]164H]6B1H+8:$S1-Q4&
M:*^]^+"S\"GUE5H)%F%W"B(EU$]%JL>]Y9;?^=2HCD+,), >D2=*M6T&@&,Y
MQ*)>. ,"`P$``3 -! () DJADB&]PT!`00%``.! () 0`2LW7&7QWA856 `-2!2WLQ
M#R-CYSWS`_GT-JB[V>.EETWJ*RG () UFIS@>; B:/3\>"EI2(WFF/"2""TVW+C
MR/;9?+ZQKU/:%+0AN-;5EN/^3 () Q98K::2OE"W8QO@:EQ__0*<FUM1 Z=\W1T
MJ-4T2>E>GNFT>N'E6A^$,)S3GZ4EV#""!,@P@@0QH ,"`0("! (``ILP#08)
M*H9(AO<-`0$%!0`P13$+, D&`U4$!A,"55,Q&# 6! () -5! H3#T=412!#;W)P
M;W)A=&EO;C$<,!H&`U4$`Q,31U1%($-Y8F5R5')U<W0 () 4F]O=# >%PTP,C X
M,C<Q.3 W,#!:%PTP-C R,C,R,S4Y,#!:,('<,0LP"08#500&$P)'0C$7,!4&
M`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;! () -5! L3%$-O;6]D;R!4<G5S="!.
M971W;W)K,48P1 8#500+$SU497)M<R!A;F0 () 0V]N9&ET:6]N<R!O9B!U<V4Z
M(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P'08#500+$Q8H
M8RDR,# R($-O;6]D;R!,:6UI=&5D,2PP* () 8#500#$R-#;VUO9&\ () 0VQA<W,@
M,R!396-U<FET>2!397)V:6-E<R!#03""`2(P#08)*H9(AO<-`0$!!0`#@@$/
M`#""`0H"@@$!`+$>8&;@0P:>)V () O`IG'B-^%Z]ME[-1)9WHN'\W<%2S6'JSR
MG48Z70/ /04L6A () -625"HW+ K2C2K3PQXDL'^UZ8ZZ () SUFFR6I[J+$FF)BY,
M\,RK0-*JWBQ.@;6Z>[A<T'N]1_7 !M+ Y-='VV) KZ$<40,8V[C0NY3'/'GJ
M)62N)AGA/&9'9Y*=>U6K-,)U;MDGCIV,\!W::YR&!**0M>J=C,_[.4.H\! () M
MGO<9$"R<+^'0L?_76<3-0#+YUX';41SR05*!0;&#N,@)_IDB1X!/G,NNX"C5
M'*QP1[ EJZ$X0A=K^FINC5]Y^/8I`S"D;D;4A5VJ0)DX=ML>`7WE#*4"`P$`
M`:."`:<P@@&C,$4&`U4='P0^,#PP.J XH#:&-&AT=' Z+R]W=W<N<'5B;&EC
M+71R=7-T+F-O;2]C9VDM8FEN+T-23"\R,# V+V-D<"YC<FPP'08#51T.!!8$
M%/92(A<5$P () #6;\8E9](M+GI_OAF,(&2! () -5'2 $ () 8HP@8<P208**H9(AOAC
M`0(!!3 [,#D&""L&`04%!P(!%BUH='1P.B\O=W=W+G!U8FQI8RUT<G5S="YC
M;VTO0U!3+T]M;FE2;V]T+FAT;6PP. () 8,*P8!! &R,0$"`0,!,"HP* 8(*P8!
M!04'` () $6'&AT='!S.B\O<V5C=7)E+F-O;6]D;RYN970O0U P6 8#51TC!%$P
M3Z%)I$<P13$+, D&`U4$!A,"55,Q&# 6! () -5! H3#T=412!#;W)P;W)A=&EO
M;C$<,!H&`U4$`Q,31U1%($-Y8F5R5')U<W0 () 4F]O=(("`:,P*P8#51T0!"0P
M(H /,C P,C X,C<Q.3 W,S%:@0\R,# U,#(R,S(S-3DP,%HP# () 8#51T/`0'_
M! 0#`@'F, \&`U4=$P0(, 8!`?\"`0`P#08)*H9(AO<-`0$%!0`# () 8$`MJ>P
M>G&+X+JS () 1XV,GJ&&-;QJTTY"'$&6F>@2P'E,$!MB;6>%:JQQ_0*QEP.Z3?>
MJ)?'W,[-<?MT` () ?<7Q4G"%,'=M2Y!NG"=U >RLFPPD:!@ "M1*I<UB#953*^
M5I;QZKV () X[P-@#KJS/N:5^UXI38]5NK1YW3*-,//L5'IX PP@@5S,(($6Z #
M` () $"`A &$Y= MM&C () SH +\@RS!+T, T&"2J&2(;W#0$!!04`,('<,0LP"08#
M500&$P)'0C$7,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;! () -5! L3%$-O
M;6]D;R!4<G5S="!.971W;W)K,48P1 8#500+$SU497)M<R!A;F0 () 0V]N9&ET
M:6]N<R!O9B!U<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y
M,1\P'08#500+$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,2PP* () 8#500#$R-#
M;VUO9&\ () 0VQA<W,@,R!396-U<FET>2!397)V:6-E<R!#03 >%PTP-# R,#4P
M,# P,#!:%PTP-3 R,#0R,S4Y-3E:,('>,34P,P8#500+$RQ#;VUO9&\ () 5')U
M<W0 () 3F5T=V]R:R M(%!%4E-/3D$ () 3D]4(%9!3$E$051%1#%&,$0&`U4$"Q,]
M5&5R;7,@86YD($-O;F1I=&EO;G,@;V8 () =7-E B!H='1P.B\O=W=W+F-O;6]D
M;RYN970O<F5P;W-I=&]R>3$?,!T&`U4$"Q,6*&,I,C P,R!#;VUO9&\ () 3&EM
M:71E9#$;,!D&`U4$`Q,22F5R96UI86@@0V]R;F5L:75S,1\P'08)*H9(AO<-
M`0D!%A!J97)E;6EA:$!N=7(N;F5T,(&?, T&"2J&2(;W#0$!`04``X&-`#"!
MB0*! () 0"P^<>BX[(WD364F9!1`AV6@>CKS5\))"5:1VE71+25*.OI4BQYMU6B
MUJGL/$#4,#7XNNA#:Y1?)(!>DE?EBRP^0Q*\UYE6(Q:4+R-[<0_6YDXR () ZFV
MCW[7LGE3W)<AIF3*`:7^LP(DES JV&45C/T9HU_;O&L'M("O,O&5&8&\H0(#
M`0`!HX(!KS""`:LP'P8#51TC!! () P%H 4]E(B%Q43" -9OQB5GTBTN>G^^&8P
M'08#51T.!!8$%$>UQ)9G:Y54FES4P):$G]1^G>S4, X&`U4=#P$!_P0$`P(%
MH# ,! () -5'1,!`?\$`C `," &`U4=)009,!<&""L&`04%!P,$! () LK!@$$`;(Q
M`0,%`C!&! () -5'2 $/S ],#L&#"L&`00!LC$!` () $!`3 K,"D&""L&`04%!P(!
M%AUH='1P<SHO+W-E8W5R92YC;VUO9&\N;F5T+T-04S"!L 8#51T?!(&H,(&E
M,#B () -J TAC)H='1P.B\O8W)L+F-O;6]D;RYN970O0VQA<W,S4V5C=7)I='E3
M97)V:6-E<U\R+F-R;# ZH#B () -H8T:'1T<#HO+V-R;"YC;VUO9&]C82YC;VTO
M0VQA<W,S4V5C=7)I='E397)V:6-E<U\R+F-R;# MH"N () *8$G0VQA<W,S4V5C
M=7)I='E397)V:6-E<U\R0&-R;"YC;VUO9&\N;F5T,!$&"6"&2 &&^$(!`00$
M`P(%(# ;! () -5'1$$%# 2 () 1!J97)E;6EA:$!N=7(N;F5T, T&"2J&2(;W#0$!
M!04``X(!`0"K?5'-&)&0>^S1,;I$U=MK62RE&FIFIG;+HD6[7]ADBZH>`ZQL
M$$4"(7#'W8,36LFTE#<QF=VS\;*F<93C$W3]W>N=Q/PN##2X;F$EKKK:^%V^
M07J(TH&J^7\F2:H\N6WT<@`_M-(&^X_THA_LE]<XRG71G ]H(;L!\F4CR_O2
M&3U[?XC\PE!:<S1U)1.5$= ]J^.<0U6E'.L*D () ?GU-[*+OUC>O@;FT<3FM%_
M+XWE-2DPO36>GI?% () WE/%+3J+HN*^#,:%8C$NE;\SPZY:STXDWKSB'0*2[MX
MI( B(SL%/[*/F:8)D& VW8XW?1!CSB-QR7G"R () A/TT'CM2 +GN(",8($<#""
M!&P"`0$P () ?$P@=PQ"S )! () -5! 83`D=",1<P%08#500*$PY#;VUO9&\ () 3&EM
M:71E9#$=,!L&`U4$"Q,40V]M;V1O(%1R=7-T($YE='=O<FLQ1C!$! () -5! L3
M/51E<FUS(&%N9"!#;VYD:71I;VYS(&]F('5S93H@:'1T<#HO+W=W=RYC;VUO
M9&\N;F5T+W)E<&]S:71O<GDQ'S =! () -5! L3%BAC*3(P,#(@0V]M;V1O($QI
M;6ET960Q+# J! () -5! ,3(T-O;6]D;R!#;&%S<R S(%-E8W5R:71Y(%-E<G9I
M8V5S($-!`A &$Y= MM&C () SH +\@RS!+T, D&!2L.`P(:!0"@@@+4,!@&"2J&
M2(;W#0$)`S$+! () DJADB&]PT!!P$P' 8)*H9(AO<-`0D%,0\7#3 T,#,P,C$V
M,38U-EHP(P8)*H9(AO<-`0D$,18$%*H_:-Y54)=0D<I%_M'FFITHC#5A,&<&
M"2J&2(;W#0$)#S%:,% () P"@8(*H9(AO<-`P<P# () 8(*H9(AO<-`P("`@" , T&
M""J&2(;W#0,"` () % , <&!2L.`P(', T&""J&2(;W#0,"` () $H, <&!2L.`P(:
M, H&""J&2(;W#0(%,((!` () 8)*P8!! &"-Q $,8'T,('Q,('<,0LP"08#500&
M$P)'0C$7,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;! () -5! L3%$-O;6]D
M;R!4<G5S="!.971W;W)K,48P1 8#500+$SU497)M<R!A;F0 () 0V]N9&ET:6]N
M<R!O9B!U<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P
M'08#500+$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,2PP* () 8#500#$R-#;VUO
M9&\ () 0VQA<W,@,R!396-U<FET>2!397)V:6-E<R!#00(0!A.70+;1HX,Z#B_(
M,LP2]#""`00&"RJ&2(;W#0$)$ (+,8'TH('Q,('<,0LP"08#500&$P)'0C$7
M,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;! () -5! L3%$-O;6]D;R!4<G5S
M="!.971W;W)K,48P1 8#500+$SU497)M<R!A;F0 () 0V]N9&ET:6]N<R!O9B!U
M<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P'08#500+
M$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,2PP* () 8#500#$R-#;VUO9&\ () 0VQA
M<W,@,R!396-U<FET>2!397)V:6-E<R!#00(0!A.70+;1HX,Z#B_(,LP2]# -
M! () DJADB&]PT!`0$%``2!@)K1C5&\6B$ () 5(5%K\^2PI1V>L">62SUR:3_OTDD
M9 (AO7&/4!_8AE -QTEK7,4<_&-PK"2YX?C'BY\3CZ;'=(^Q!SFUI7?=T,YB
MEUM2>;610/*2(R9R'3G)3'55VZSDQWCV`!'39 44:MX^_HC$].'/M!=O2F U
/S1GJ81"^H%=;````````
`
end


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault