Seeing a weird extra create parameter (extra info) from a Windows Server 2008R2 or Windows Server 2012 CreateFile rquests

[Richard Sharpe]

Hi folks,

I have a couple of captures that contain something like 168 bytes of
garbage at the end of a Create request that contains the following
string:

\x9c\xcb\xcf\x9e\x04\xc1\xe6C\x98\x0e\x15\x8d\xa1\xf6\xec\x83

Wireshark thinks it is another Extra Info field.

I wonder what the new MS tool will make of it.

Has anyone else seen these?

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)