blob: cdcf2b53a096d64dd1c1b3d0e5ddbe9d1e65f713 (plain)

ofs	hex dump	ascii
0000	21 3c 61 72 63 68 3e 0a 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 33 38 30 35 35 34 38	!<arch>./...............13805548
0020	30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 36 36 38 20 20 20 20 20	06..............0.......668.....
0040	20 20 60 0a 00 00 00 1d 00 00 05 c2 00 00 07 f0 00 00 09 28 00 00 0f 9a 00 00 0f 9a 00 00 0b c2	..`................(............
0060	00 00 0b c2 00 00 0c 2c 00 00 0c 2c 00 00 0f 32 00 00 0f 32 00 00 0b 58 00 00 0b 58 00 00 0d 0c	.......,...,...2...2...X...X....
0080	00 00 0d 0c 00 00 0d ec 00 00 0d ec 00 00 0e c8 00 00 0e c8 00 00 0e 5a 00 00 0e 5a 00 00 0a 7c	.......................Z...Z...|
00a0	00 00 0a 7c 00 00 0a ea 00 00 0a ea 00 00 0d 7c 00 00 0d 7c 00 00 0c 9e 00 00 0c 9e 5f 5f 49 4d	...|...........|...|........__IM
00c0	50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 5f 73 65 6b 75 72 6c 73 61 00 5f 5f 4e 55 4c 4c 5f	PORT_DESCRIPTOR_sekurlsa.__NULL_
00e0	49 4d 50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 00 7f 73 65 6b 75 72 6c 73 61 5f 4e 55 4c 4c	IMPORT_DESCRIPTOR..sekurlsa_NULL
0100	5f 54 48 55 4e 4b 5f 44 41 54 41 00 5f 5f 69 6d 70 5f 5f 70 69 6e 67 00 5f 70 69 6e 67 00 5f 5f	_THUNK_DATA.__imp__ping._ping.__
0120	69 6d 70 5f 5f 67 65 74 43 72 65 64 6d 61 6e 00 5f 67 65 74 43 72 65 64 6d 61 6e 00 5f 5f 69 6d	imp__getCredman._getCredman.__im
0140	70 5f 5f 67 65 74 43 72 65 64 6d 61 6e 46 75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 43 72 65 64 6d	p__getCredmanFunctions._getCredm
0160	61 6e 46 75 6e 63 74 69 6f 6e 73 00 5f 5f 69 6d 70 5f 5f 69 6e 63 6f 67 6e 69 74 6f 00 5f 69 6e	anFunctions.__imp__incognito._in
0180	63 6f 67 6e 69 74 6f 00 5f 5f 69 6d 70 5f 5f 66 69 6e 64 5f 74 6f 6b 65 6e 73 00 5f 66 69 6e 64	cognito.__imp__find_tokens._find
01a0	5f 74 6f 6b 65 6e 73 00 5f 5f 69 6d 70 5f 5f 67 65 74 4c 6f 63 61 6c 41 63 63 6f 75 6e 74 73 00	_tokens.__imp__getLocalAccounts.
01c0	5f 67 65 74 4c 6f 63 61 6c 41 63 63 6f 75 6e 74 73 00 5f 5f 69 6d 70 5f 5f 67 65 74 53 41 4d 46	_getLocalAccounts.__imp__getSAMF
01e0	75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 53 41 4d 46 75 6e 63 74 69 6f 6e 73 00 5f 5f 69 6d 70 5f	unctions._getSAMFunctions.__imp_
0200	5f 67 65 74 53 65 63 72 65 74 73 00 5f 67 65 74 53 65 63 72 65 74 73 00 5f 5f 69 6d 70 5f 5f 67	_getSecrets._getSecrets.__imp__g
0220	65 74 53 45 43 46 75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 53 45 43 46 75 6e 63 74 69 6f 6e 73 00	etSECFunctions._getSECFunctions.
0240	5f 5f 69 6d 70 5f 5f 61 64 64 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 00 5f 61 64 64 4c 6f 67 6f 6e	__imp__addLogonSession._addLogon
0260	53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 5f 64 65 6c 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 00 5f	Session.__imp__delLogonSession._
0280	64 65 6c 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 5f 67 65 74 4c 6f 67 6f 6e 53	delLogonSession.__imp__getLogonS
02a0	65 73 73 69 6f 6e 73 00 5f 67 65 74 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 73 00 5f 5f 69 6d 70 5f	essions._getLogonSessions.__imp_
02c0	5f 67 65 74 44 65 73 63 72 69 70 74 69 6f 6e 00 5f 67 65 74 44 65 73 63 72 69 70 74 69 6f 6e 00	_getDescription._getDescription.
02e0	2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20	/...............1380554806......
0300	20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 36 37 38 20 20 20 20 20 20 20 60 0a 10 00 00 00	........0.......678.......`.....
0320	c2 05 00 00 f0 07 00 00 28 09 00 00 9a 0f 00 00 c2 0b 00 00 2c 0c 00 00 32 0f 00 00 58 0b 00 00	........(...........,...2...X...
0340	0c 0d 00 00 ec 0d 00 00 c8 0e 00 00 5a 0e 00 00 7c 0a 00 00 ea 0a 00 00 7c 0d 00 00 9e 0c 00 00	............Z...|.......|.......
0360	1d 00 00 00 01 00 02 00 0d 00 0e 00 08 00 05 00 06 00 10 00 09 00 0f 00 0a 00 0c 00 0b 00 07 00	................................
0380	04 00 0d 00 0e 00 08 00 05 00 06 00 10 00 09 00 0f 00 0a 00 0c 00 0b 00 07 00 04 00 03 00 5f 5f	..............................__
03a0	49 4d 50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 5f 73 65 6b 75 72 6c 73 61 00 5f 5f 4e 55 4c	IMPORT_DESCRIPTOR_sekurlsa.__NUL
03c0	4c 5f 49 4d 50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 00 5f 5f 69 6d 70 5f 5f 61 64 64 4c 6f	L_IMPORT_DESCRIPTOR.__imp__addLo
03e0	67 6f 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 5f 64 65 6c 4c 6f 67 6f 6e 53 65 73 73 69 6f	gonSession.__imp__delLogonSessio
0400	6e 00 5f 5f 69 6d 70 5f 5f 66 69 6e 64 5f 74 6f 6b 65 6e 73 00 5f 5f 69 6d 70 5f 5f 67 65 74 43	n.__imp__find_tokens.__imp__getC
0420	72 65 64 6d 61 6e 00 5f 5f 69 6d 70 5f 5f 67 65 74 43 72 65 64 6d 61 6e 46 75 6e 63 74 69 6f 6e	redman.__imp__getCredmanFunction
0440	73 00 5f 5f 69 6d 70 5f 5f 67 65 74 44 65 73 63 72 69 70 74 69 6f 6e 00 5f 5f 69 6d 70 5f 5f 67	s.__imp__getDescription.__imp__g
0460	65 74 4c 6f 63 61 6c 41 63 63 6f 75 6e 74 73 00 5f 5f 69 6d 70 5f 5f 67 65 74 4c 6f 67 6f 6e 53	etLocalAccounts.__imp__getLogonS
0480	65 73 73 69 6f 6e 73 00 5f 5f 69 6d 70 5f 5f 67 65 74 53 41 4d 46 75 6e 63 74 69 6f 6e 73 00 5f	essions.__imp__getSAMFunctions._
04a0	5f 69 6d 70 5f 5f 67 65 74 53 45 43 46 75 6e 63 74 69 6f 6e 73 00 5f 5f 69 6d 70 5f 5f 67 65 74	_imp__getSECFunctions.__imp__get
04c0	53 65 63 72 65 74 73 00 5f 5f 69 6d 70 5f 5f 69 6e 63 6f 67 6e 69 74 6f 00 5f 5f 69 6d 70 5f 5f	Secrets.__imp__incognito.__imp__
04e0	70 69 6e 67 00 5f 61 64 64 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 00 5f 64 65 6c 4c 6f 67 6f 6e 53	ping._addLogonSession._delLogonS
0500	65 73 73 69 6f 6e 00 5f 66 69 6e 64 5f 74 6f 6b 65 6e 73 00 5f 67 65 74 43 72 65 64 6d 61 6e 00	ession._find_tokens._getCredman.
0520	5f 67 65 74 43 72 65 64 6d 61 6e 46 75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 44 65 73 63 72 69 70	_getCredmanFunctions._getDescrip
0540	74 69 6f 6e 00 5f 67 65 74 4c 6f 63 61 6c 41 63 63 6f 75 6e 74 73 00 5f 67 65 74 4c 6f 67 6f 6e	tion._getLocalAccounts._getLogon
0560	53 65 73 73 69 6f 6e 73 00 5f 67 65 74 53 41 4d 46 75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 53 45	Sessions._getSAMFunctions._getSE
0580	43 46 75 6e 63 74 69 6f 6e 73 00 5f 67 65 74 53 65 63 72 65 74 73 00 5f 69 6e 63 6f 67 6e 69 74	CFunctions._getSecrets._incognit
05a0	6f 00 5f 70 69 6e 67 00 7f 73 65 6b 75 72 6c 73 61 5f 4e 55 4c 4c 5f 54 48 55 4e 4b 5f 44 41 54	o._ping..sekurlsa_NULL_THUNK_DAT
05c0	41 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20	A.sekurlsa.dll/...1380554806....
05e0	20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 34 39 38 20 20 20 20 20 20 20 60 0a 4c 01	..........0.......498.......`.L.
0600	03 00 36 98 49 52 0e 01 00 00 08 00 00 00 00 00 00 01 2e 64 65 62 75 67 24 53 00 00 00 00 00 00	..6.IR.............debug$S......
0620	00 00 42 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2e 69 64 61 74 61	..B...................@..B.idata
0640	24 32 00 00 00 00 00 00 00 00 14 00 00 00 ce 00 00 00 e2 00 00 00 00 00 00 00 03 00 00 00 40 00	$2............................@.
0660	30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0e 00 00 00 00 01 00 00 e2 00 00 00 00 00	0..idata$6......................
0680	00 00 00 00 00 00 40 00 20 c0 02 00 00 00 13 00 09 00 00 00 00 00 0c 73 65 6b 75 72 6c 73 61 2e	......@................sekurlsa.
06a0	64 6c 6c 27 00 13 10 07 00 00 00 03 00 00 00 00 00 00 00 0a 00 00 00 6f 76 12 4d 69 63 72 6f 73	dll'...................ov.Micros
06c0	6f 66 74 20 28 52 29 20 4c 49 4e 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	oft.(R).LINK....................
06e0	0c 00 00 00 03 00 00 00 07 00 00 00 00 00 04 00 00 00 07 00 10 00 00 00 05 00 00 00 07 00 73 65	..............................se
0700	6b 75 72 6c 73 61 2e 64 6c 6c 00 00 40 63 6f 6d 70 2e 69 64 6f 76 9c 00 ff ff 00 00 03 00 00 00	kurlsa.dll..@comp.idov..........
0720	00 00 04 00 00 00 00 00 00 00 02 00 00 00 02 00 2e 69 64 61 74 61 24 32 40 00 00 c0 02 00 00 00	.................idata$2@.......
0740	68 00 2e 69 64 61 74 61 24 36 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 34 40 00 00 c0	h..idata$6...........idata$4@...
0760	00 00 00 00 68 00 2e 69 64 61 74 61 24 35 40 00 00 c0 00 00 00 00 68 00 00 00 00 00 21 00 00 00	....h..idata$5@.......h.....!...
0780	00 00 00 00 00 00 00 00 02 00 00 00 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 02 00 54 00 00 00	..............:.............T...
07a0	5f 5f 49 4d 50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 5f 73 65 6b 75 72 6c 73 61 00 5f 5f 4e	__IMPORT_DESCRIPTOR_sekurlsa.__N
07c0	55 4c 4c 5f 49 4d 50 4f 52 54 5f 44 45 53 43 52 49 50 54 4f 52 00 7f 73 65 6b 75 72 6c 73 61 5f	ULL_IMPORT_DESCRIPTOR..sekurlsa_
07e0	4e 55 4c 4c 5f 54 48 55 4e 4b 5f 44 41 54 41 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20	NULL_THUNK_DATA.sekurlsa.dll/...
0800	31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20	1380554806..............0.......
0820	32 35 31 20 20 20 20 20 20 20 60 0a 4c 01 02 00 36 98 49 52 ba 00 00 00 02 00 00 00 00 00 00 01	251.......`.L...6.IR............
0840	2e 64 65 62 75 67 24 53 00 00 00 00 00 00 00 00 42 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00	.debug$S........B...d...........
0860	00 00 00 00 40 00 10 42 2e 69 64 61 74 61 24 33 00 00 00 00 00 00 00 00 14 00 00 00 a6 00 00 00	....@..B.idata$3................
0880	00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 02 00 00 00 13 00 09 00 00 00 00 00 0c 73 65 6b	............@.0..............sek
08a0	75 72 6c 73 61 2e 64 6c 6c 27 00 13 10 07 00 00 00 03 00 00 00 00 00 00 00 0a 00 00 00 6f 76 12	urlsa.dll'...................ov.
08c0	4d 69 63 72 6f 73 6f 66 74 20 28 52 29 20 4c 49 4e 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Microsoft.(R).LINK..............
08e0	00 00 00 00 00 00 40 63 6f 6d 70 2e 69 64 6f 76 9c 00 ff ff 00 00 03 00 00 00 00 00 04 00 00 00	......@comp.idov................
0900	00 00 00 00 02 00 00 00 02 00 1d 00 00 00 5f 5f 4e 55 4c 4c 5f 49 4d 50 4f 52 54 5f 44 45 53 43	..............__NULL_IMPORT_DESC
0920	52 49 50 54 4f 52 00 0a 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38	RIPTOR..sekurlsa.dll/...13805548
0940	30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 32 38 30 20 20 20 20 20	06..............0.......280.....
0960	20 20 60 0a 4c 01 03 00 36 98 49 52 d6 00 00 00 02 00 00 00 00 00 00 01 2e 64 65 62 75 67 24 53	..`.L...6.IR.............debug$S
0980	00 00 00 00 00 00 00 00 42 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42	........B...................@..B
09a0	2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 04 00 00 00 ce 00 00 00 00 00 00 00 00 00 00 00	.idata$5........................
09c0	00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 04 00 00 00 d2 00 00 00	....@.0..idata$4................
09e0	00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 02 00 00 00 13 00 09 00 00 00 00 00 0c 73 65 6b	............@.0..............sek
0a00	75 72 6c 73 61 2e 64 6c 6c 27 00 13 10 07 00 00 00 03 00 00 00 00 00 00 00 0a 00 00 00 6f 76 12	urlsa.dll'...................ov.
0a20	4d 69 63 72 6f 73 6f 66 74 20 28 52 29 20 4c 49 4e 4b 00 00 00 00 00 00 00 00 40 63 6f 6d 70 2e	Microsoft.(R).LINK........@comp.
0a40	69 64 6f 76 9c 00 ff ff 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 02 00 00 00 02 00 1e 00	idov............................
0a60	00 00 7f 73 65 6b 75 72 6c 73 61 5f 4e 55 4c 4c 5f 54 48 55 4e 4b 5f 44 41 54 41 00 73 65 6b 75	...sekurlsa_NULL_THUNK_DATA.seku
0a80	72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20	rlsa.dll/...1380554806..........
0aa0	20 20 20 20 30 20 20 20 20 20 20 20 35 30 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01	....0.......50........`.......L.
0ac0	36 98 49 52 1e 00 00 00 00 00 08 00 5f 61 64 64 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 00 73 65 6b	6.IR........_addLogonSession.sek
0ae0	75 72 6c 73 61 2e 64 6c 6c 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35	urlsa.dll.sekurlsa.dll/...138055
0b00	34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 35 30 20 20 20 20	4806..............0.......50....
0b20	20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 1e 00 00 00 01 00 08 00 5f 64 65 6c 4c 6f	....`.......L.6.IR........_delLo
0b40	67 6f 6e 53 65 73 73 69 6f 6e 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 73 65 6b 75 72 6c 73 61	gonSession.sekurlsa.dll.sekurlsa
0b60	2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20	.dll/...1380554806..............
0b80	30 20 20 20 20 20 20 20 34 36 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52	0.......46........`.......L.6.IR
0ba0	1a 00 00 00 02 00 08 00 5f 66 69 6e 64 5f 74 6f 6b 65 6e 73 00 73 65 6b 75 72 6c 73 61 2e 64 6c	........_find_tokens.sekurlsa.dl
0bc0	6c 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20	l.sekurlsa.dll/...1380554806....
0be0	20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 34 35 20 20 20 20 20 20 20 20 60 0a 00 00	..........0.......45........`...
0c00	ff ff 00 00 4c 01 36 98 49 52 19 00 00 00 03 00 08 00 5f 67 65 74 43 72 65 64 6d 61 6e 00 73 65	....L.6.IR........_getCredman.se
0c20	6b 75 72 6c 73 61 2e 64 6c 6c 00 0a 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30	kurlsa.dll..sekurlsa.dll/...1380
0c40	35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 35 34 20 20	554806..............0.......54..
0c60	20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 22 00 00 00 04 00 08 00 5f 67 65 74	......`.......L.6.IR"......._get
0c80	43 72 65 64 6d 61 6e 46 75 6e 63 74 69 6f 6e 73 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 73 65	CredmanFunctions.sekurlsa.dll.se
0ca0	6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20	kurlsa.dll/...1380554806........
0cc0	20 20 20 20 20 20 30 20 20 20 20 20 20 20 34 39 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00	......0.......49........`.......
0ce0	4c 01 36 98 49 52 1d 00 00 00 05 00 08 00 5f 67 65 74 44 65 73 63 72 69 70 74 69 6f 6e 00 73 65	L.6.IR........_getDescription.se
0d00	6b 75 72 6c 73 61 2e 64 6c 6c 00 0a 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30	kurlsa.dll..sekurlsa.dll/...1380
0d20	35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 35 31 20 20	554806..............0.......51..
0d40	20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 1f 00 00 00 06 00 08 00 5f 67 65 74	......`.......L.6.IR........_get
0d60	4c 6f 63 61 6c 41 63 63 6f 75 6e 74 73 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 0a 73 65 6b 75	LocalAccounts.sekurlsa.dll..seku
0d80	72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20	rlsa.dll/...1380554806..........
0da0	20 20 20 20 30 20 20 20 20 20 20 20 35 31 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01	....0.......51........`.......L.
0dc0	36 98 49 52 1f 00 00 00 07 00 08 00 5f 67 65 74 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 73 00 73 65	6.IR........_getLogonSessions.se
0de0	6b 75 72 6c 73 61 2e 64 6c 6c 00 0a 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30	kurlsa.dll..sekurlsa.dll/...1380
0e00	35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 35 30 20 20	554806..............0.......50..
0e20	20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 1e 00 00 00 08 00 08 00 5f 67 65 74	......`.......L.6.IR........_get
0e40	53 41 4d 46 75 6e 63 74 69 6f 6e 73 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 73 65 6b 75 72 6c	SAMFunctions.sekurlsa.dll.sekurl
0e60	73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20	sa.dll/...1380554806............
0e80	20 20 30 20 20 20 20 20 20 20 35 30 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98	..0.......50........`.......L.6.
0ea0	49 52 1e 00 00 00 09 00 08 00 5f 67 65 74 53 45 43 46 75 6e 63 74 69 6f 6e 73 00 73 65 6b 75 72	IR........_getSECFunctions.sekur
0ec0	6c 73 61 2e 64 6c 6c 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38	lsa.dll.sekurlsa.dll/...13805548
0ee0	30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20 20 20 34 35 20 20 20 20 20 20	06..............0.......45......
0f00	20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 19 00 00 00 0a 00 08 00 5f 67 65 74 53 65 63 72	..`.......L.6.IR........_getSecr
0f20	65 74 73 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 0a 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 2f 20	ets.sekurlsa.dll..sekurlsa.dll/.
0f40	20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 20 20 20 20	..1380554806..............0.....
0f60	20 20 34 34 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98 49 52 18 00 00 00 0b 00	..44........`.......L.6.IR......
0f80	08 00 5f 69 6e 63 6f 67 6e 69 74 6f 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 73 65 6b 75 72 6c	.._incognito.sekurlsa.dll.sekurl
0fa0	73 61 2e 64 6c 6c 2f 20 20 20 31 33 38 30 35 35 34 38 30 36 20 20 20 20 20 20 20 20 20 20 20 20	sa.dll/...1380554806............
0fc0	20 20 30 20 20 20 20 20 20 20 33 39 20 20 20 20 20 20 20 20 60 0a 00 00 ff ff 00 00 4c 01 36 98	..0.......39........`.......L.6.
0fe0	49 52 13 00 00 00 0c 00 08 00 5f 70 69 6e 67 00 73 65 6b 75 72 6c 73 61 2e 64 6c 6c 00 0a	IR........_ping.sekurlsa.dll..