Arne Vidstrom has something useful here: http://ntsecurity.nu/toolbox/
ListModules <http://ntsecurity.nu/toolbox/listmodules/> ListModules lists the modules (EXE's and DLL's) that are loaded into a process. This can be useful in a forensic investigation. > OS: Windows NT 4.0 / 2000 / XP > Version: 1.1 > File Size: 28 kb > First release: 2002.02.16 begin 666 smime.p7s M,( &"2J&2(;W#0$'`J" ,( "`0$Q"S )[EMAIL PROTECTED]@,"&@4`,( &"2J&2(;W#0$' M`0``H((,03""`?HP@@%C`@(!HS [EMAIL PROTECTED]&]PT!`00%`#!%,0LP"08#500& M$P)54S$8,!8&`U4$"A,/1U1%($-O<G!O<F%T:6]N,1PP&@8#500#$Q-'5$4@ M0WEB97)4<G5S="!2;V]T,!X7#3DV,#(R,S(S,#$P,%H7#3 V,#(R,S(S-3DP M,%HP13$+, D&`U4$!A,"55,Q&# [EMAIL PROTECTED] H3#T=412!#;W)P;W)A=&EO;C$< M,!H&`U4$`Q,31U1%($-Y8F5R5')U<[EMAIL PROTECTED]"!GS [EMAIL PROTECTED]&]PT!`0$% [EMAIL PROTECTED]"@8$`N.9/NMN8?'%\KT2WTP]&V63ED\%"CL>Z28TU+7KGB[WE M!3%9QK$O"@S[GZ<[EMAIL PROTECTED]>-RD;A^E^#,J:GZ5_]164H]6B1H+8:$S1-Q4& M:*^]^+"S\"GUE5H)%F%W"B(EU$]%JL>]Y9;?^=2HCD+,), >D2=*M6T&@&,Y MQ*)>. ,"`P$``3 [EMAIL PROTECTED]&[EMAIL PROTECTED]&7QWA856 `-2!2WLQ M#R-CYSWS`_GT-JB[V>[EMAIL PROTECTED]@>; B:/3\>"EI2(WFF/"2""TVW+C MR/;9?+ZQKU/:%+0AN-;5EN/[EMAIL PROTECTED]::2OE"W8QO@:EQ__0*<FUM1 Z=\W1T MJ-4T2>E>GNFT>N'E6A^$,)S3GZ4EV#""!,@P@@0QH ,"`0("! (``ILP#08) M*H9(AO<-`0$%!0`P13$+, D&`U4$!A,"55,Q&# [EMAIL PROTECTED] H3#T=412!#;W)P M;W)A=&EO;C$<,!H&`U4$`Q,31U1%($-Y8F5R5')U<[EMAIL PROTECTED] >%PTP,C X M,C<Q.3 W,#!:%PTP-C R,C,R,S4Y,#!:,('<,0LP"08#500&$P)'0C$7,!4& M`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;[EMAIL PROTECTED] L3%$-O;6]D;R!4<G5S="!. M971W;W)K,48P1 8#500+$SU497)M<R!A;[EMAIL PROTECTED]&ET:6]N<R!O9B!U<V4Z M(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P'08#500+$Q8H M8RDR,# R($-O;6]D;R!,:6UI=&5D,[EMAIL PROTECTED];VUO9&[EMAIL PROTECTED]<W,@ M,R!396-U<FET>2!397)V:6-E<R!#03""`2(P#08)*H9(AO<-`0$!!0`#@@$/ M`#""`0H"@@$!`+$>8&;@0P:>)[EMAIL PROTECTED]'B-^%Z]ME[-1)9WHN'\W<%2S6'JSR MG48Z70/ /[EMAIL PROTECTED]"HW+ K2C2K3PQXDL'[EMAIL PROTECTED])BY, M\,RK0-*JWBQ.@;6Z>[A<T'N]1_7 !M+ Y-='VV) KZ$<40,8V[C0NY3'/'GJ M)62N)AGA/&9'9Y*=>U6K-,)U;MDGCIV,\!W::YR&!**0M>J=C,[EMAIL PROTECTED] MGO<9$"R<+^'0L?_76<3-0#+YUX';41SR05*!0;&#N,@)_IDB1X!/G,NNX"C5 M'*QP1[ EJZ$X0A=K^FINC5]Y^/8I`S"D;D;4A5VJ0)DX=ML>`7WE#*4"`P$` M`:."`:<P@@&C,$4&`U4='P0^,#PP.J XH#:&-&AT=' Z+R]W=W<N<'5B;&EC M+71R=7-T+F-O;2]C9VDM8FEN+T-23"\R,# V+V-D<"YC<FPP'08#51T.!!8$ M%/92(A<[EMAIL PROTECTED];\8E9](M+GI_OAF,(&[EMAIL PROTECTED]'2 [EMAIL PROTECTED]@8<P208**H9(AOAC M`0(!!3 [,#D&""L&`04%!P(!%BUH='1P.B\O=W=W+G!U8FQI8RUT<G5S="YC M;VTO0U!3+T]M;FE2;V]T+FAT;[EMAIL PROTECTED],*P8!! &R,0$"`0,!,"HP* 8(*P8! M!04'[EMAIL PROTECTED]'&AT='!S.B\O<V5C=7)E+F-O;6]D;RYN970O0U P6 8#51TC!%$P M3Z%)I$<P13$+, D&`U4$!A,"55,Q&# [EMAIL PROTECTED] H3#T=412!#;W)P;W)A=&EO M;C$<,!H&`U4$`Q,31U1%($-Y8F5R5')U<[EMAIL PROTECTED](("`:,P*P8#51T0!"0P M(H /,C P,C X,C<Q.3 W,S%:@0\R,# U,#(R,S(S-3DP,[EMAIL PROTECTED]/`0'_ M! 0#`@'F, \&`U4=$P0(, 8!`?\"`0`P#08)*H9(AO<[EMAIL PROTECTED]>P M>G&[EMAIL PROTECTED],GJ&&-;QJTTY"'$&6F>@2P'E,$!MB;6>%:JQQ_0*QEP.Z3?> MJ)?'W,[-<[EMAIL PROTECTED]<7Q4G"%,'=M2Y!NG"=U >RLFPPD:!@ "M1*I<UB#953*^ M5I;[EMAIL PROTECTED]@#KJS/N:5^UXI38]5NK1YW3*-,//L5'IX PP@@5S,(($6Z # [EMAIL PROTECTED]"`A &$Y= MM&[EMAIL PROTECTED]@RS!+T, T&"2J&2(;W#0$!!04`,('<,0LP"08# M500&$P)'0C$7,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;[EMAIL PROTECTED] L3%$-O M;6]D;R!4<G5S="!.971W;W)K,48P1 8#500+$SU497)M<R!A;[EMAIL PROTECTED]&ET M:6]N<R!O9B!U<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y M,1\P'08#500+$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,[EMAIL PROTECTED] M;VUO9&[EMAIL PROTECTED]<W,@,R!396-U<FET>2!397)V:6-E<R!#03 >%PTP-# R,#4P M,# P,#!:%PTP-3 R,#0R,S4Y-3E:,('>,34P,P8#500+$RQ#;VUO9&[EMAIL PROTECTED]')U M<[EMAIL PROTECTED]:R M(%!%4E-/[EMAIL PROTECTED](%9!3$E$051%1#%&,$0&`U4$"Q,] M5&5R;7,@86YD($-O;F1I=&EO;G,@;[EMAIL PROTECTED]'1P.B\O=W=W+F-O;6]D M;RYN970O<F5P;W-I=&]R>3$?,!T&`U4$"Q,6*&,I,C P,R!#;VUO9&[EMAIL PROTECTED]&EM M:71E9#$;,!D&`U4$`Q,22F5R96UI86@@0V]R;F5L:75S,1\P'08)*H9(AO<- M`0D!%A!J97)E;6EA:$!N=7(N;F5T,(&?, T&"2J&2(;W#0$!`04``X&-`#"! [EMAIL PROTECTED]"P^<>BX[(WD364F9!1`AV6@>CKS5\))"5:1VE71+25*.OI4BQYMU6B MUJGL/$#4,#7XNNA#:Y1?)(!>DE?EBRP^0Q*\UYE6(Q:4+R-[<[EMAIL PROTECTED] MCW[7LGE3W)<AIF3*`:7^LP(DES JV&45C/T9HU_;O&L'M("O,O&5&8&\H0(# M`0`!HX(!KS""`:LP'[EMAIL PROTECTED] 4]E(B%Q43" -9OQB5GTBTN>G^^&8P M'08#51T.!!8$%$>UQ)9G:Y54FES4P):$G]1^G>S4, X&`U4=#P$!_P0$`P(% MH# ,[EMAIL PROTECTED]'1,!`?\$`C `," &`U4=)009,!<&""L&`04%!P,[EMAIL PROTECTED]@$$`;(Q M`0,%`C!&[EMAIL PROTECTED]'2 $/S ],#L&#"L&[EMAIL PROTECTED] K,"D&""L&`04%!P(! M%AUH='1P<SHO+W-E8W5R92YC;VUO9&\N;F5T+T-04S"!L 8#51T?!(&H,(&E M,[EMAIL PROTECTED] TAC)H='1P.B\O8W)L+F-O;6]D;RYN970O0VQA<W,S4V5C=7)I='E3 M97)V:6-E<U\R+F-R;# [EMAIL PROTECTED]:'1T<#HO+V-R;"YC;VUO9&]C82YC;VTO M0VQA<W,S4V5C=7)I='E397)V:6-E<U\R+F-R;# MH"[EMAIL PROTECTED]<W,S4V5C M=7)I='E397)V:6-E<U\R0&-R;"YC;VUO9&\N;F5T,!$&"6"&2 &&^$(!`00$ M`P(%(# ;[EMAIL PROTECTED]'1$$%# [EMAIL PROTECTED])E;6EA:$!N=7(N;F5T, T&"2J&2(;W#0$! M!04``X(!`0"K?5'-&)&0>^S1,;I$U=MK62RE&FIFIG;+HD6[7]ADBZH>`ZQL M$$4"(7#'W8,36LFTE#<QF=VS\;*F<93C$W3]W>N=Q/PN##2X;F$EKKK:^%V^ M07J(TH&J^7\F2:H\N6WT<@`_M-(&^X_THA_LE]<XRG71G ]H(;L!\F4CR_O2 M&3U[?XC\PE!:<S1U)1.5$= ]J^.<0U6E'[EMAIL PROTECTED]>O@;FT<3FM%_ M+XWE-2DPO36>[EMAIL PROTECTED]/%+3J+HN*^#,:%8C$NE;\SPZY:STXDWKSB'0*2[MX MI( B(SL%/[*/F:8)D& VW8XW?1!CSB-QR7G"[EMAIL PROTECTED]/TT'CM2 +GN(",8($<#"" M!&P"[EMAIL PROTECTED]@=PQ"S )[EMAIL PROTECTED] 83`D=",1<P%08#500*$PY#;VUO9&[EMAIL PROTECTED]&EM M:71E9#$=,!L&`U4$"Q,40V]M;V1O(%1R=7-T($YE='=O<[EMAIL PROTECTED] L3 M/51E<FUS(&%N9"!#;VYD:71I;VYS(&]F('5S93H@:'1T<#HO+W=W=RYC;VUO M9&\N;F5T+W)E<&]S:71O<GDQ'S [EMAIL PROTECTED] L3%BAC*3(P,#(@0V]M;V1O($QI M;6ET960Q+# [EMAIL PROTECTED] ,3(T-O;6]D;R!#;&%S<R S(%-E8W5R:71Y(%-E<G9I M8V5S($-!`A &$Y= MM&[EMAIL PROTECTED]@RS!+T, D&!2L.`P(:!0"@@@+4,!@&"2J& M2(;W#0$)[EMAIL PROTECTED]&]PT!!P$P' 8)*H9(AO<-`0D%,0\7#3 T,#,P,C$V M,38U-EHP(P8)*H9(AO<-`0D$,18$%*H_:-Y54)=0D<I%_M'FFITHC#5A,&<& M"2J&2(;W#0$)#S%:,[EMAIL PROTECTED]"@8(*H9(AO<-`P<[EMAIL PROTECTED](*H9(AO<-`P("`@" , T& M""J&2(;W#0,"[EMAIL PROTECTED] , <&!2L.`P(', T&""J&2(;W#0,"[EMAIL PROTECTED], <&!2L.`P(: M, H&""J&2(;W#0(%,(([EMAIL PROTECTED])*P8!! &"-Q $,8'T,('Q,('<,0LP"08#500& M$P)'0C$7,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;[EMAIL PROTECTED] L3%$-O;6]D M;R!4<G5S="!.971W;W)K,48P1 8#500+$SU497)M<R!A;[EMAIL PROTECTED]&ET:6]N M<R!O9B!U<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P M'08#500+$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,[EMAIL PROTECTED];VUO M9&[EMAIL PROTECTED]<W,@,R!396-U<FET>2!397)V:6-E<R!#00(0!A.70+;1HX,Z#B_( M,LP2]#""`00&"RJ&2(;W#0$)$ (+,8'TH('Q,('<,0LP"08#500&$P)'0C$7 M,!4&`U4$"A,.0V]M;V1O($QI;6ET960Q'3 ;[EMAIL PROTECTED] L3%$-O;6]D;R!4<G5S M="!.971W;W)K,48P1 8#500+$SU497)M<R!A;[EMAIL PROTECTED]&ET:6]N<R!O9B!U M<V4Z(&AT=' Z+R]W=W<N8V]M;V1O+FYE="]R97!O<VET;W)Y,1\P'08#500+ M$Q8H8RDR,# R($-O;6]D;R!,:6UI=&5D,[EMAIL PROTECTED];VUO9&[EMAIL PROTECTED] M<W,@,R!396-U<FET>2!397)V:6-E<R!#00(0!A.70+;1HX,Z#B_(,LP2]# - [EMAIL PROTECTED]&]PT!`0$%``2!@)K1C5&[EMAIL PROTECTED](5%K\^2PI1V>L">62SUR:3_OTDD M9 (AO7&/4!_8AE -QTEK7,4<_&-PK"2YX?C'BY\3CZ;'=(^Q!SFUI7?=T,YB MEUM2>;610/*2(R9R'3G)3'55VZSDQWCV`!'39 44:MX^_HC$].'/M!=O2F U /S1GJ81"^H%=;```````` ` end _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
