C# POC to extract NetNTLMv1/v2 hashes from ETW provider - View it on GitHub