You may try to locate the value from the snapshot and then correlate it.
Do you know which value is the logon token? Or you know it, just don't know how to correlate? What did you do on the correlation? Did you tried to correlate some value to solve this issue?
