DPAPI Credential Extraction

Extract and decrypt secrets stored in Windows Credential Manager credential lockers. Credential files such as .vcrd are DPAPI-protected and must be resolved with the corresponding user or system masterkey. A local route can enumerate a user's credential files and, where authorized access permits, list cached masterkeys from LSASS; the cached key must match the blob's masterkey. Remote alternatives include DonPAPI's CredMan collector and Hekatomb, which require authorized credentials, the appropriate remote access, and a domain DPAPI backup key or other supported key source. A domain DPAPI backup key is a specific recovery mechanism, not a generic reference to a domain controller's private keys.