============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 4E 00 74 00 4C 00 6D 00 53 00 73 00 70 00 00 00 00 00 00 00 4E 00 74 00 4C 00 6D 00 53 00 65 00 N.t.L.m.S.s.p.......N.t.L.m.S.e. 00000020 63 00 75 00 72 00 69 00 74 00 79 00 53 00 75 00 70 00 70 00 6F 00 72 00 74 00 50 00 72 00 6F 00 c.u.r.i.t.y.S.u.p.p.o.r.t.P.r.o. 00000040 76 00 69 00 64 00 65 00 72 00 45 00 76 00 65 00 6E 00 74 00 00 00 00 00 CC 11 C9 76 F9 11 C9 76 v.i.d.e.r.E.v.e.n.t.....╠◄╔v∙◄╔v 00000060 0D 12 C9 76 D0 12 C9 76 56 13 C9 76 70 13 C9 76 89 13 C9 76 84 13 C9 76 5C 00 4E 00 74 00 4C 00 ♪↕╔v╨↕╔vV‼╔vp‼╔vë‼╔vä‼╔v\.N.t.L. 00000080 6D 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 53 00 75 00 70 00 70 00 6F 00 72 00 74 00 m.S.e.c.u.r.i.t.y.S.u.p.p.o.r.t. 000000A0 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 50 00 6F 00 72 00 74 00 00 00 00 00 00 00 00 00 P.r.o.v.i.d.e.r.P.o.r.t......... 000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000100 C0 60 C9 76 00 00 00 00 00 00 00 00 00 00 00 00 C4 60 C9 76 00 00 00 00 00 01 00 00 00 00 00 00 └`╔v............─`╔v.....☺...... 00000120 C8 60 C9 76 00 00 00 00 00 02 00 00 00 00 00 00 CC 60 C9 76 00 00 00 00 00 05 00 00 02 00 00 00 ╚`╔v.....☻......╠`╔v.....♣..☻... 00000140 D0 60 C9 76 00 00 00 00 00 05 00 00 12 00 00 00 D4 60 C9 76 00 00 00 00 00 05 00 00 20 00 00 00 ╨`╔v.....♣..↕...╘`╔v.....♣.. ... 00000160 D8 60 C9 76 20 02 00 00 DC 60 C9 76 20 02 00 00 E0 60 C9 76 21 02 00 00 E4 60 C9 76 22 02 00 00 ╪`╔v ☻..▄`╔v ☻..α`╔v!☻..Σ`╔v"☻.. 00000180 E8 60 C9 76 23 02 00 00 EC 60 C9 76 24 02 00 00 F0 60 C9 76 25 02 00 00 F4 60 C9 76 26 02 00 00 Φ`╔v#☻..∞`╔v$☻..≡`╔v%☻..⌠`╔v&☻.. 000001A0 F8 60 C9 76 27 02 00 00 00 00 00 00 00 00 00 00 05 00 00 00 22 00 00 C0 39 00 00 00 C2 00 00 C0 °`╔v'☻..........♣..."..└9...┬..└ 000001C0 B7 00 00 00 35 00 00 C0 16 02 00 00 95 00 00 C0 42 00 00 00 CB 00 00 C0 C1 00 00 00 7B 00 00 C0 ╖...5..└▬☻..ò..└B...╦..└┴...{..└ 000001E0 18 00 00 00 3E 00 00 C0 35 00 00 00 BE 00 00 C0 43 00 00 00 CC 00 00 C0 3A 00 00 00 C3 00 00 C0 ↑...>..└5...╛..└C...╠..└:...├..└ 00000200 A1 00 00 00 3B 00 00 C0 E6 00 00 00 AD 00 00 C0 3C 00 00 00 C5 00 00 C0 6F 00 00 00 05 00 00 80 í...;..└µ...¡..└<...┼..└o...♣..Ç 00000220 AA 00 00 00 11 00 00 80 17 00 00 00 3F 00 00 C0 10 00 00 00 01 01 00 C0 37 00 00 00 C0 00 00 C0 ¬...◄..Ç↨...?..└►...☺☺.└7...└..└ 00000240 0B 01 00 00 03 01 00 C0 70 00 00 00 7F 00 00 C0 34 00 00 00 BD 00 00 C0 13 01 00 00 50 00 00 C0 ♂☺..♥☺.└p...⌂..└4...╜..└‼☺..P..└ 00000260 1A 01 00 00 4F 00 00 C0 02 00 00 00 0F 00 00 C0 1F 00 00 00 01 00 00 C0 26 00 00 00 11 00 00 C0 →☺..O..└☻...☼..└▼...☺..└&...◄..└ 00000280 E7 01 00 00 A0 00 00 C0 FE 00 00 00 13 00 00 80 01 00 00 00 02 00 00 C0 06 00 00 00 08 00 00 C0 τ☺..á..└■...‼..Ç☺...☻..└♠...◘..└ 000002A0 7B 00 00 00 33 00 00 C0 57 00 00 00 0D 00 00 C0 56 00 00 00 6A 00 00 C0 E5 03 00 00 03 01 00 00 {...3..└W...♪..└V...j..└σ♥..♥☺.. 000002C0 21 00 00 00 55 00 00 C0 69 05 00 00 5B 01 00 C0 40 00 00 00 C9 00 00 C0 41 00 00 00 CA 00 00 C0 !...U..└i♣..[☺.└@...╔..└A...╩..└ 000002E0 36 00 00 00 BF 00 00 C0 58 00 00 00 D2 00 00 C0 E6 03 00 00 05 00 00 C0 1A 00 00 00 32 00 00 C0 6...┐..└X...╥..└µ♥..♣..└→...2..└ 00000300 08 00 00 00 17 00 00 C0 9E 00 00 00 7E 00 00 C0 20 01 00 00 46 00 00 C0 15 00 00 00 10 00 00 80 ◘...↨..└₧...~..└ ☺..F..└§...►..Ç 00000320 11 00 00 00 D4 00 00 C0 32 00 00 00 BB 00 00 C0 E8 00 00 00 B1 00 00 C0 12 00 00 00 06 00 00 80 ◄...╘..└2...╗..└Φ...▒..└↕...♠..Ç 00000340 03 01 00 00 12 00 00 80 3E 00 00 00 C7 00 00 C0 1C 00 00 00 0E 00 00 80 03 00 00 00 3A 00 00 C0 ♥☺..↕..Ç>...╟..└∟...♫..Ç♥...:..└ 00000360 E7 00 00 00 AC 00 00 C0 E9 00 00 00 B0 00 00 C0 3D 00 00 00 C6 00 00 C0 3F 00 00 00 C8 00 00 C0 τ...¼..└Θ...░..└=...╞..└?...╚..└ 00000380 7F 00 00 00 7A 00 00 C0 48 00 00 00 D1 00 00 C0 33 00 00 00 BC 00 00 C0 47 00 00 00 D0 00 00 C0 ⌂...z..└H...╤..└3...╝..└G...╨..└ 000003A0 1B 00 00 00 15 00 00 C0 79 00 00 00 B5 00 00 C0 46 00 00 00 CF 00 00 C0 20 00 00 00 43 00 00 C0 ←...§..└y...╡..└F...╧..└ ...C..└ 000003C0 E7 03 00 00 06 00 00 C0 38 00 00 00 C1 00 00 C0 44 00 00 00 CD 00 00 C0 04 00 00 00 1F 01 00 C0 τ♥..♠..└8...┴..└D...═..└♦...▼☺.└ 000003E0 2A 01 00 00 47 00 00 C0 45 00 00 00 CE 00 00 C0 3B 00 00 00 C4 00 00 C0 F0 00 00 00 D6 00 00 C0 *☺..G..└E...╬..└;...─..└≡...╓..└ 00000400 22 00 00 00 12 00 00 C0 00 07 00 00 92 01 00 C0 01 07 00 00 93 01 00 C0 75 07 00 00 34 02 00 C0 "...↕..└.•..Æ☺.└☺•..ô☺.└u•..4☻.└ 00000420 73 07 00 00 24 02 00 C0 0F 07 00 00 98 01 00 C0 10 07 00 00 99 01 00 C0 11 07 00 00 9A 01 00 C0 s•..$☻.└☼•..ÿ☺.└►•..Ö☺.└◄•..Ü☺.└ 00000440 12 07 00 00 9B 01 00 C0 4A 05 00 00 DE 00 00 C0 BF 08 00 00 93 01 00 C0 B3 08 00 00 DD 00 00 C0 ↕•..¢☺.└J♣..▐..└┐◘..ô☺.└│◘..▌..└ 00000460 B4 08 00 00 58 01 00 C0 9B 08 00 00 6A 00 00 C0 9A 08 00 00 62 00 00 C0 4B 08 00 00 23 00 00 C0 ┤◘..X☺.└¢◘..j..└Ü◘..b..└K◘..#..└ 00000480 98 09 00 00 58 01 00 C0 64 09 00 00 08 01 00 C0 AF 08 00 00 65 00 00 C0 AC 08 00 00 73 00 00 C0 ÿ○..X☺.└d○..◘☺.└»◘..e..└¼◘..s..└ 000004A0 C7 08 00 00 E4 00 00 C0 C1 08 00 00 6F 00 00 C0 C0 08 00 00 70 00 00 C0 36 08 00 00 FB 00 00 C0 ╟◘..Σ..└┴◘..o..└└◘..p..└6◘..√..└ 000004C0 B2 08 00 00 87 01 00 C0 61 09 00 00 07 01 00 C0 C2 08 00 00 71 00 00 C0 BA 08 00 00 25 01 00 C0 ▓◘..ç☺.└a○..•☺.└┬◘..q..└║◘..%☺.└ 000004E0 B0 08 00 00 63 00 00 C0 BC 08 00 00 67 00 00 C0 BD 08 00 00 68 00 00 C0 AD 08 00 00 64 00 00 C0 ░◘..c..└╝◘..g..└╜◘..h..└¡◘..d..└ 00000500 A2 08 00 00 32 01 00 C0 99 09 00 00 33 01 00 C0 C9 08 00 00 34 01 00 C0 95 09 00 00 33 02 00 C0 ó◘..2☺.└Ö○..3☺.└╔◘..4☺.└ò○..3☻.└ 00000520 5A 08 00 00 17 00 02 C0 42 08 00 00 17 00 02 C0 88 08 00 00 17 00 02 C0 C5 08 00 00 6C 00 00 C0 Z◘..↨.☻└B◘..↨.☻└ê◘..↨.☻└┼◘..l..└ 00000540 C3 08 00 00 6C 00 00 C0 C6 08 00 00 6C 00 00 C0 00 00 00 00 4E 54 4C 4D 53 53 50 00 4E 74 4C 6D ├◘..l..└╞◘..l..└....NTLMSSP.NtLm 00000560 53 73 70 20 00 00 00 00 5C 00 00 00 4D 49 43 52 4F 53 4F 46 54 5F 41 55 54 48 45 4E 54 49 43 41 Ssp ....\...MICROSOFT_AUTHENTICA 00000580 54 49 4F 4E 5F 50 41 43 4B 41 47 45 5F 56 31 5F 30 00 00 00 4E 54 4C 4D 20 53 65 63 75 72 69 74 TION_PACKAGE_V1_0...NTLM Securit 000005A0 79 20 50 61 63 6B 61 67 65 00 00 00 5C 00 4C 00 73 00 61 00 41 00 75 00 74 00 68 00 65 00 6E 00 y Package...\.L.s.a.A.u.t.h.e.n. 000005C0 74 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 50 00 6F 00 72 00 74 00 00 00 00 00 5C 00 53 00 t.i.c.a.t.i.o.n.P.o.r.t.....\.S. 000005E0 45 00 43 00 55 00 52 00 49 00 54 00 59 00 5C 00 4C 00 53 00 41 00 5F 00 41 00 55 00 54 00 48 00 E.C.U.R.I.T.Y.\.L.S.A._.A.U.T.H. 00000600 45 00 4E 00 54 00 49 00 43 00 41 00 54 00 49 00 4F 00 4E 00 5F 00 49 00 4E 00 49 00 54 00 49 00 E.N.T.I.C.A.T.I.O.N._.I.N.I.T.I. 00000620 41 00 4C 00 49 00 5A 00 45 00 44 00 00 00 00 00 4C 53 41 20 41 55 3A 20 50 61 63 6B 61 67 65 20 A.L.I.Z.E.D.....LSA AU: Package 00000640 4C 6F 6F 6B 75 70 20 4E 74 52 65 71 75 65 73 74 57 61 69 74 52 65 70 6C 79 20 46 61 69 6C 65 64 Lookup NtRequestWaitReply Failed 00000660 20 30 78 25 6C 78 0A 00 4C 53 41 20 41 55 3A 20 44 65 52 72 65 67 69 73 74 65 72 4C 6F 67 6F 6E 0x%lx◙.LSA AU: DeRregisterLogon 00000680 50 72 6F 63 65 73 73 20 46 61 69 6C 65 64 20 30 78 25 6C 78 0A 00 00 00 00 00 00 00 00 00 00 00 Process Failed 0x%lx◙........... 000006A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000006C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000006E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000007A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000007C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................