ETWHash is a small C# tool used during Red Team engagements, that can consume ETW SMB events and extract NetNTLMv2 hashes for cracking offline, unlike currently documented methods.  GitHub: https://github.com/nettitude/ETWHash Microsoft ETW (Event [...]