Module ImportFrom alias alias ImportFrom alias ImportFrom alias ImportFrom alias ClassDef bases body FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam NameParam defaults NameLoad body Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr NameLoad If CompareIsNot NameLoad NameLoad body If CompareNotEq Call AttributeLoad NameLoad attr Str Num body Assign TupleStore AttributeStore NameLoad attr AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Str orelse Assign AttributeStore NameLoad attr NameLoad If CompareIs AttributeLoad NameLoad attr NameLoad body Assign AttributeStore NameLoad attr Str Assign NameStore BinOpMod Str AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr NameLoad If Call NameLoad AttributeLoad NameLoad attr Str body Expr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults NameLoad body Assign AttributeStore NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Return AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam defaults body FunctionDef arguments args NameParam defaults body Assign AttributeStore NameLoad attr NameLoad decorator_list Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Expr Call AttributeLoad NameLoad attr Call AttributeLoad AttributeLoad NameLoad attr attr Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore Call NameLoad Num Assign NameStore Str If AttributeLoad NameLoad attr body Assign NameStore BinOpAdd NameLoad Str AugAssignAdd NameStore Call AttributeLoad Str attr NameLoad NameLoad orelse If CompareIs AttributeLoad NameLoad attr NameLoad body AugAssignAdd NameStore Call AttributeLoad Str attr NameLoad Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr NameLoad BinOpMod Str NameLoad NameLoad AttributeLoad NameLoad attr NameLoad AttributeLoad NameLoad attr Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr NameLoad BinOpMod Str NameLoad Assign NameStore NameLoad While UnaryOpNot NameLoad body Assign NameStore Call AttributeLoad NameLoad attr NameLoad BinOpMod Str NameLoad If CompareNotEq SubscriptLoad SubscriptLoad NameLoad Index Str Index Str Num body Assign NameStore NameLoad orelse Expr Call NameLoad Num Expr Call AttributeLoad NameLoad attr NameLoad BinOpMod Str NameLoad Assign NameStore NameLoad If CompareIs NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr NameLoad BinOpMod Str NameLoad Assign NameStore Call AttributeLoad Str attr Call NameLoad NameLoad Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr If AttributeLoad NameLoad attr body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr While NameLoad body TryExcept body Expr Call AttributeLoad NameLoad attr Str BinOpMod Str NameLoad NameLoad Break handlers ExceptHandler type NameLoad name NameStore body If CompareGt Call AttributeLoad Call NameLoad NameLoad attr Str Num body Expr Call NameLoad Num orelse If CompareGtE Call AttributeLoad Call NameLoad NameLoad attr Str Num body Expr Call NameLoad Num orelse Raise Expr Call AttributeLoad NameLoad attr Str BinOpMod Str NameLoad orelse Pass Expr Call AttributeLoad NameLoad attr decorator_list decorator_list
N/A impacket.dcerpc.v5 tsch transport impacket.dcerpc.v5.dtypes NULL core.helpers gen_random_string gevent sleep TSCH_EXEC N/A N/A __init__ N/A N/A self target username password domain hashes N/A None N/A N/A N/A self __target target N/A N/A self __username username N/A N/A self __password password N/A N/A self __domain domain N/A N/A self __lmhash N/A N/A self __nthash N/A N/A self __outputBuffer N/A N/A self __retOutput False N/A N/A hashes None N/A N/A N/A N/A N/A hashes find : -1 N/A N/A N/A N/A self __lmhash N/A self __nthash N/A N/A hashes split : N/A N/A N/A self __nthash hashes N/A N/A N/A self __password None N/A N/A N/A self __password N/A stringbinding N/A ncacn_np:%s[\pipe\atsvc] N/A self __target N/A N/A self __rpctransport N/A N/A transport DCERPCTransportFactory stringbinding N/A N/A hasattr N/A self __rpctransport set_credentials N/A N/A N/A N/A N/A self __rpctransport set_credentials N/A self __username N/A self __password N/A self __domain N/A self __lmhash N/A self __nthash N/A execute N/A N/A self command output N/A False N/A N/A N/A self __retOutput output N/A N/A N/A self doStuff command N/A N/A self __outputBuffer N/A doStuff N/A N/A self command N/A N/A output_callback N/A N/A data N/A N/A N/A N/A self __outputBuffer data N/A N/A dce N/A N/A N/A self __rpctransport get_dce_rpc N/A N/A N/A dce set_credentials N/A N/A N/A self __rpctransport get_credentials N/A N/A N/A dce connect N/A N/A N/A dce bind N/A tsch MSRPC_UUID_TSCHS N/A tmpName N/A gen_random_string 8 N/A xml <?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="LocalSystem">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>true</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="LocalSystem">
    <Exec>
      <Command>cmd.exe</Command>
 N/A N/A self __retOutput N/A N/A tmpFileName N/A tmpName .tmp N/A xml N/A N/A       <Arguments>/C {} &gt; %windir%\Temp\{} 2&gt;&amp;1</Arguments>
    </Exec>
  </Actions>
</Task>
         format command tmpFileName N/A N/A N/A N/A self __retOutput False N/A N/A xml N/A N/A       <Arguments>/C {}</Arguments>
    </Exec>
  </Actions>
</Task>
         format command N/A taskCreated False N/A N/A N/A tsch hSchRpcRegisterTask dce N/A \%s tmpName xml N/A tsch TASK_CREATE NULL N/A tsch TASK_LOGON_NONE N/A taskCreated True N/A N/A N/A tsch hSchRpcRun dce N/A \%s tmpName N/A done False N/A N/A done N/A N/A resp N/A N/A tsch hSchRpcGetLastRunInfo dce N/A \%s tmpName N/A N/A N/A N/A resp N/A pLastRuntime N/A wYear 0 N/A N/A done True N/A N/A N/A sleep 2 N/A N/A N/A tsch hSchRpcDelete dce N/A \%s tmpName N/A taskCreated False N/A N/A taskCreated True N/A N/A N/A N/A tsch hSchRpcDelete dce N/A \%s tmpName N/A peer N/A N/A : join N/A map str N/A N/A N/A N/A N/A self __rpctransport get_socket getpeername N/A N/A self __retOutput N/A N/A smbConnection N/A N/A N/A self __rpctransport get_smb_connection N/A True N/A N/A N/A N/A N/A N/A smbConnection getFile ADMIN$ N/A Temp\%s tmpFileName output_callback N/A N/A N/A N/A Exception N/A e N/A N/A N/A N/A N/A N/A str e find SHARING 0 N/A N/A N/A sleep 3 N/A N/A N/A N/A N/A N/A str e find STATUS_OBJECT_NAME_NOT_FOUND 0 N/A N/A N/A sleep 3 N/A N/A N/A N/A N/A smbConnection deleteFile ADMIN$ N/A Temp\%s tmpFileName N/A N/A N/A N/A N/A dce disconnect N/A N/A