We can see the first packet is a normal ClientHello sent by the client, and the second packet is a crafted packet sent by the server.  In order to examine exploitation of this vulnerability, we used WinDBG to attach to the lsass.exe process.