drop dpapi blob export or registry csv · identify master key scope · flag credential vault entries · correlate user sids · runs locally
dpapi / registry export
drop export
or click
RECmd / reg export · SharpDPAPI · MasterKeys under Microsoft\Protect\{sid}
drop dpapi blob export or registry csv