Hello,

I am on a network/domain using Responder and getting hashes like this:

HTTP or SMB NTLMv1
:user::sysname or domain:674HDN4K1IU8163N00000000000000000000000000000000:JFD23J4LKOI7QYHRLK5IAKELKU5829POIRLOASI98237IKLE:112233445566778899

The clients on the network have LM off, so what am i seeing in the LM part of this hash? It should be all zeros right? Thanks.