creddump file parsing fix