============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 41 00 75 00 74 00 6F 00 41 00 64 00 W.i.n.l.o.g.o.n.....A.u.t.o.A.d. 00000020 6D 00 69 00 6E 00 4C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 4C 00 4F 00 47 00 4F 00 4E 00 53 00 m.i.n.L.o.g.o.n.....L.O.G.O.N.S. 00000040 45 00 52 00 56 00 45 00 52 00 00 00 00 00 00 00 00 00 00 00 25 00 73 00 00 00 00 00 FF FF FF FF E.R.V.E.R...........%.s..... 00000060 4C 00 65 00 67 00 61 00 6C 00 4E 00 6F 00 74 00 69 00 63 00 65 00 54 00 65 00 78 00 74 00 00 00 L.e.g.a.l.N.o.t.i.c.e.T.e.x.t... 00000080 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 4C 00 65 00 67 00 61 00 6C 00 4E 00 W.i.n.l.o.g.o.n.....L.e.g.a.l.N. 000000A0 6F 00 74 00 69 00 63 00 65 00 43 00 61 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 00 00 00 00 o.t.i.c.e.C.a.p.t.i.o.n......... 000000C0 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 W.i.n.l.o.g.o.n.....D.e.f.a.u.l. 000000E0 74 00 44 00 6F 00 6D 00 61 00 69 00 6E 00 4E 00 61 00 6D 00 65 00 00 00 41 00 75 00 74 00 6F 00 t.D.o.m.a.i.n.N.a.m.e...A.u.t.o. 00000100 41 00 64 00 6D 00 69 00 6E 00 4C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 30 00 00 00 57 00 69 00 A.d.m.i.n.L.o.g.o.n.....0...W.i. 00000120 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 50 00 n.l.o.g.o.n.....D.e.f.a.u.l.t.P. 00000140 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 a.s.s.w.o.r.d...W.i.n.l.o.g.o.n. 00000160 00 00 00 00 49 00 67 00 6E 00 6F 00 72 00 65 00 53 00 68 00 69 00 66 00 74 00 4F 00 76 00 65 00 ....I.g.n.o.r.e.S.h.i.f.t.O.v.e. 00000180 72 00 72 00 69 00 64 00 65 00 00 00 41 00 75 00 74 00 6F 00 41 00 64 00 6D 00 69 00 6E 00 4C 00 r.r.i.d.e...A.u.t.o.A.d.m.i.n.L. 000001A0 6F 00 67 00 6F 00 6E 00 00 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 o.g.o.n.....W.i.n.l.o.g.o.n..... 000001C0 53 00 68 00 75 00 74 00 64 00 6F 00 77 00 6E 00 57 00 69 00 74 00 68 00 6F 00 75 00 74 00 4C 00 S.h.u.t.d.o.w.n.W.i.t.h.o.u.t.L. 000001E0 6F 00 67 00 6F 00 6E 00 00 00 00 00 00 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 o.g.o.n.........W.i.n.l.o.g.o.n. 00000200 00 00 00 00 44 00 6F 00 6E 00 74 00 44 00 69 00 73 00 70 00 6C 00 61 00 79 00 4C 00 61 00 73 00 ....D.o.n.t.D.i.s.p.l.a.y.L.a.s. 00000220 74 00 55 00 73 00 65 00 72 00 4E 00 61 00 6D 00 65 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 t.U.s.e.r.N.a.m.e...W.i.n.l.o.g. 00000240 6F 00 6E 00 00 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 55 00 73 00 65 00 72 00 4E 00 o.n.....D.e.f.a.u.l.t.U.s.e.r.N. 00000260 61 00 6D 00 65 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 44 00 6F 00 6D 00 61 00 69 00 a.m.e...D.e.f.a.u.l.t.D.o.m.a.i. 00000280 6E 00 4E 00 61 00 6D 00 65 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 55 00 73 00 65 00 n.N.a.m.e...D.e.f.a.u.l.t.U.s.e. 000002A0 72 00 4E 00 61 00 6D 00 65 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 r.N.a.m.e...W.i.n.l.o.g.o.n..... 000002C0 52 00 65 00 70 00 6F 00 72 00 74 00 42 00 6F 00 6F 00 74 00 4F 00 4B 00 00 00 00 00 30 00 00 00 R.e.p.o.r.t.B.o.o.t.O.K.....0... 000002E0 01 00 00 00 00 00 00 00 00 00 00 00 53 00 68 00 75 00 74 00 64 00 6F 00 77 00 6E 00 20 00 53 00 ☺...........S.h.u.t.d.o.w.n. .S. 00000300 65 00 74 00 74 00 69 00 6E 00 67 00 00 00 00 00 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 00 e.t.t.i.n.g.....S.O.F.T.W.A.R.E. 00000320 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 57 00 69 00 6E 00 64 00 6F 00 \.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o. 00000340 77 00 73 00 20 00 4E 00 54 00 5C 00 43 00 75 00 72 00 72 00 65 00 6E 00 74 00 56 00 65 00 72 00 w.s. .N.T.\.C.u.r.r.e.n.t.V.e.r. 00000360 73 00 69 00 6F 00 6E 00 5C 00 53 00 68 00 75 00 74 00 64 00 6F 00 77 00 6E 00 00 00 57 00 69 00 s.i.o.n.\.S.h.u.t.d.o.w.n...W.i. 00000380 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 50 00 6F 00 77 00 65 00 72 00 64 00 6F 00 77 00 n.l.o.g.o.n.....P.o.w.e.r.d.o.w. 000003A0 6E 00 41 00 66 00 74 00 65 00 72 00 53 00 68 00 75 00 74 00 64 00 6F 00 77 00 6E 00 00 00 00 00 n.A.f.t.e.r.S.h.u.t.d.o.w.n..... 000003C0 43 00 61 00 63 00 68 00 65 00 4C 00 61 00 73 00 74 00 55 00 70 00 64 00 61 00 74 00 65 00 00 00 C.a.c.h.e.L.a.s.t.U.p.d.a.t.e... 000003E0 57 00 49 00 4E 00 4C 00 4F 00 47 00 4F 00 4E 00 00 00 00 00 43 00 61 00 63 00 68 00 65 00 4C 00 W.I.N.L.O.G.O.N.....C.a.c.h.e.L. 00000400 61 00 73 00 74 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 6C 00 65 00 72 00 00 00 57 00 49 00 a.s.t.C.o.n.t.r.o.l.l.e.r...W.I. 00000420 4E 00 4C 00 4F 00 47 00 4F 00 4E 00 00 00 00 00 43 00 61 00 63 00 68 00 65 00 50 00 72 00 69 00 N.L.O.G.O.N.....C.a.c.h.e.P.r.i. 00000440 6D 00 61 00 72 00 79 00 44 00 6F 00 6D 00 61 00 69 00 6E 00 00 00 00 00 57 00 49 00 4E 00 4C 00 m.a.r.y.D.o.m.a.i.n.....W.I.N.L. 00000460 4F 00 47 00 4F 00 4E 00 00 00 00 00 43 00 61 00 63 00 68 00 65 00 54 00 72 00 75 00 73 00 74 00 O.G.O.N.....C.a.c.h.e.T.r.u.s.t. 00000480 65 00 64 00 44 00 6F 00 6D 00 61 00 69 00 6E 00 73 00 00 00 57 00 49 00 4E 00 4C 00 4F 00 47 00 e.d.D.o.m.a.i.n.s...W.I.N.L.O.G. 000004A0 4F 00 4E 00 00 00 00 00 43 00 61 00 63 00 68 00 65 00 56 00 61 00 6C 00 69 00 64 00 00 00 00 00 O.N.....C.a.c.h.e.V.a.l.i.d..... 000004C0 43 00 61 00 63 00 68 00 65 00 56 00 61 00 6C 00 69 00 64 00 00 00 00 00 43 00 61 00 63 00 68 00 C.a.c.h.e.V.a.l.i.d.....C.a.c.h. 000004E0 65 00 56 00 61 00 6C 00 69 00 64 00 00 00 00 00 43 00 61 00 63 00 68 00 65 00 4C 00 61 00 73 00 e.V.a.l.i.d.....C.a.c.h.e.L.a.s. 00000500 74 00 55 00 70 00 64 00 61 00 74 00 65 00 00 00 43 00 61 00 63 00 68 00 65 00 56 00 61 00 6C 00 t.U.p.d.a.t.e...C.a.c.h.e.V.a.l. 00000520 69 00 64 00 00 00 00 00 25 00 63 00 00 00 00 00 4E 00 45 00 54 00 4C 00 4F 00 47 00 4F 00 4E 00 i.d.....%.c.....N.E.T.L.O.G.O.N. 00000540 00 00 00 00 43 6C 6F 73 65 53 65 72 76 69 63 65 48 61 6E 64 6C 65 00 00 51 75 65 72 79 53 65 72 ....CloseServiceHandle..QuerySer 00000560 76 69 63 65 53 74 61 74 75 73 00 00 4F 70 65 6E 53 65 72 76 69 63 65 57 00 00 00 00 4F 70 65 6E viceStatus..OpenServiceW....Open 00000580 53 43 4D 61 6E 61 67 65 72 57 00 00 61 64 76 61 70 69 33 32 2E 64 6C 6C 00 00 00 00 20 00 00 00 SCManagerW..advapi32.dll.... ... 000005A0 00 00 00 00 00 05 00 00 00 00 00 00 00 02 00 00 4D 49 43 52 4F 53 4F 46 54 5F 41 55 54 48 45 4E .....♣.......☻..MICROSOFT_AUTHEN 000005C0 54 49 43 41 54 49 4F 4E 5F 50 41 43 4B 41 47 45 5F 56 31 5F 30 00 00 00 57 69 6E 6C 6F 67 6F 6E TICATION_PACKAGE_V1_0...Winlogon 000005E0 5C 4D 53 47 69 6E 61 00 57 69 6E 6C 6F 67 6F 6E 00 00 00 00 55 73 65 72 33 32 20 20 00 00 00 00 \MSGina.Winlogon....User32 .... 00000600 50 00 41 00 54 00 48 00 00 00 00 00 50 00 61 00 72 00 73 00 65 00 41 00 75 00 74 00 6F 00 65 00 P.A.T.H.....P.a.r.s.e.A.u.t.o.e. 00000620 78 00 65 00 63 00 00 00 50 00 61 00 72 00 73 00 65 00 41 00 75 00 74 00 6F 00 65 00 78 00 65 00 x.e.c...P.a.r.s.e.A.u.t.o.e.x.e. 00000640 63 00 00 00 53 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 c...S.o.f.t.w.a.r.e.\.M.i.c.r.o. 00000660 73 00 6F 00 66 00 74 00 5C 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4E 00 54 00 5C 00 s.o.f.t.\.W.i.n.d.o.w.s. .N.T.\. 00000680 43 00 75 00 72 00 72 00 65 00 6E 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 5C 00 57 00 C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.W. 000006A0 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 31 00 00 00 50 00 41 00 54 00 48 00 00 00 00 00 i.n.l.o.g.o.n...1...P.A.T.H..... 000006C0 41 00 75 00 74 00 6F 00 65 00 78 00 65 00 63 00 50 00 61 00 74 00 68 00 00 00 00 00 50 00 41 00 A.u.t.o.e.x.e.c.P.a.t.h.....P.A. 000006E0 54 00 48 00 00 00 00 00 55 00 53 00 45 00 52 00 44 00 4F 00 4D 00 41 00 49 00 4E 00 00 00 00 00 T.H.....U.S.E.R.D.O.M.A.I.N..... 00000700 55 00 53 00 45 00 52 00 4E 00 41 00 4D 00 45 00 00 00 00 00 2C 00 00 00 2C 00 00 00 57 00 69 00 U.S.E.R.N.A.M.E.....,...,...W.i. 00000720 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 55 00 73 00 65 00 72 00 69 00 6E 00 69 00 74 00 n.l.o.g.o.n.....U.s.e.r.i.n.i.t. 00000740 00 00 00 00 75 00 73 00 65 00 72 00 69 00 6E 00 69 00 74 00 2E 00 65 00 78 00 65 00 00 00 00 00 ....u.s.e.r.i.n.i.t...e.x.e..... 00000760 54 00 52 00 55 00 45 00 00 00 00 00 57 00 69 00 6E 00 6C 00 6F 00 67 00 6F 00 6E 00 00 00 00 00 T.R.U.E.....W.i.n.l.o.g.o.n..... 00000780 52 00 65 00 70 00 6F 00 72 00 74 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 6C 00 65 00 72 00 R.e.p.o.r.t.C.o.n.t.r.o.l.l.e.r. 000007A0 4D 00 69 00 73 00 73 00 69 00 6E 00 67 00 00 00 54 00 52 00 55 00 45 00 00 00 00 00 55 00 73 00 M.i.s.s.i.n.g...T.R.U.E.....U.s. 000007C0 65 00 72 00 49 00 6E 00 69 00 74 00 4D 00 70 00 72 00 4C 00 6F 00 67 00 6F 00 6E 00 53 00 63 00 e.r.I.n.i.t.M.p.r.L.o.g.o.n.S.c. 000007E0 72 00 69 00 70 00 74 00 00 00 00 00 55 00 73 00 65 00 72 00 49 00 6E 00 69 00 74 00 4C 00 6F 00 r.i.p.t.....U.s.e.r.I.n.i.t.L.o. 00000800 67 00 6F 00 6E 00 53 00 63 00 72 00 69 00 70 00 74 00 00 00 55 00 73 00 65 00 72 00 49 00 6E 00 g.o.n.S.c.r.i.p.t...U.s.e.r.I.n. 00000820 69 00 74 00 4C 00 6F 00 67 00 6F 00 6E 00 53 00 65 00 72 00 76 00 65 00 72 00 00 00 01 00 00 00 i.t.L.o.g.o.n.S.e.r.v.e.r...☺... 00000840 3B 00 00 00 4F 00 73 00 32 00 4C 00 69 00 62 00 50 00 61 00 74 00 68 00 00 00 00 00 4C 00 69 00 ;...O.s.2.L.i.b.P.a.t.h.....L.i. 00000860 62 00 50 00 61 00 74 00 68 00 00 00 50 00 41 00 54 00 48 00 00 00 00 00 45 00 6E 00 76 00 69 00 b.P.a.t.h...P.A.T.H.....E.n.v.i. 00000880 72 00 6F 00 6E 00 6D 00 65 00 6E 00 74 00 00 00 48 00 4F 00 4D 00 45 00 50 00 41 00 54 00 48 00 r.o.n.m.e.n.t...H.O.M.E.P.A.T.H. 000008A0 00 00 00 00 48 00 4F 00 4D 00 45 00 53 00 48 00 41 00 52 00 45 00 00 00 48 00 4F 00 4D 00 45 00 ....H.O.M.E.S.H.A.R.E...H.O.M.E. 000008C0 44 00 52 00 49 00 56 00 45 00 00 00 5A 00 3A 00 00 00 00 00 5C 00 00 00 48 00 4F 00 4D 00 45 00 D.R.I.V.E...Z.:.....\...H.O.M.E. 000008E0 50 00 41 00 54 00 48 00 00 00 00 00 48 00 4F 00 4D 00 45 00 53 00 48 00 41 00 52 00 45 00 00 00 P.A.T.H.....H.O.M.E.S.H.A.R.E... 00000900 48 00 4F 00 4D 00 45 00 44 00 52 00 49 00 56 00 45 00 00 00 5C 00 00 00 5C 00 00 00 5C 00 75 00 H.O.M.E.D.R.I.V.E...\...\...\.u. 00000920 73 00 65 00 72 00 73 00 00 00 00 00 5C 00 75 00 73 00 65 00 72 00 73 00 00 00 00 00 5C 00 75 00 s.e.r.s.....\.u.s.e.r.s.....\.u. 00000940 73 00 65 00 72 00 73 00 5C 00 64 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00 00 00 5C 00 75 00 s.e.r.s.\.d.e.f.a.u.l.t.....\.u. 00000960 73 00 65 00 72 00 73 00 5C 00 64 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00 00 00 53 45 54 00 s.e.r.s.\.d.e.f.a.u.l.t.....SET. 00000980 50 41 54 48 00 00 00 00 63 00 3A 00 5C 00 61 00 75 00 74 00 6F 00 65 00 78 00 65 00 63 00 2E 00 PATH....c.:.\.a.u.t.o.e.x.e.c... 000009A0 62 00 61 00 74 00 00 00 26 0A 0D 00 41 00 75 00 74 00 6F 00 65 00 78 00 65 00 63 00 50 00 61 00 b.a.t...&◙♪.A.u.t.o.e.x.e.c.P.a. 000009C0 74 00 68 00 00 00 00 00 50 00 41 00 54 00 48 00 00 00 00 00 41 00 75 00 74 00 6F 00 65 00 78 00 t.h.....P.A.T.H.....A.u.t.o.e.x. 000009E0 65 00 63 00 50 00 61 00 74 00 68 00 00 00 00 00 00 00 00 00 50 00 41 00 54 00 48 00 00 00 00 00 e.c.P.a.t.h.........P.A.T.H..... 00000A00 43 00 4F 00 4D 00 53 00 50 00 45 00 43 00 00 00 25 00 00 00 50 00 41 00 54 00 48 00 25 00 00 00 C.O.M.S.P.E.C...%...P.A.T.H.%... 00000A20 25 00 00 00 4C 00 61 00 6E 00 6D 00 61 00 6E 00 57 00 6F 00 72 00 6B 00 73 00 74 00 61 00 74 00 %...L.a.n.m.a.n.W.o.r.k.s.t.a.t. 00000A40 69 00 6F 00 6E 00 00 00 57 4E 65 74 41 64 64 43 6F 6E 6E 65 63 74 69 6F 6E 32 57 00 6D 00 70 00 i.o.n...WNetAddConnection2W.m.p. 00000A60 72 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5C 00 4C 00 73 00 61 00 r...d.l.l...............\.L.s.a. 00000A80 41 00 75 00 74 00 68 00 65 00 6E 00 74 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 50 00 6F 00 A.u.t.h.e.n.t.i.c.a.t.i.o.n.P.o. 00000AA0 72 00 74 00 00 00 00 00 5C 00 53 00 45 00 43 00 55 00 52 00 49 00 54 00 59 00 5C 00 4C 00 53 00 r.t.....\.S.E.C.U.R.I.T.Y.\.L.S. 00000AC0 41 00 5F 00 41 00 55 00 54 00 48 00 45 00 4E 00 54 00 49 00 43 00 41 00 54 00 49 00 4F 00 4E 00 A._.A.U.T.H.E.N.T.I.C.A.T.I.O.N. 00000AE0 5F 00 49 00 4E 00 49 00 54 00 49 00 41 00 4C 00 49 00 5A 00 45 00 44 00 00 00 00 00 00 00 00 00 _.I.N.I.T.I.A.L.I.Z.E.D......... 00000B00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000B20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000B40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000B60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000B80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000BA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000BC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000BE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................