Just used Jay’s script for identifying hashes in shellcode with great success. A+++, would use again. https://www.mandiant.com/blog/archives/3863