Dump SAM and LSA Secrets

Composite entry currently combines distinct Windows credential-material sources: SAM local-account hashes; LSA secrets and cached logon credential data; and LSASS process memory. ATT&CK maps these separately to T1003.002 (SAM), T1003.004 (LSA Secrets), T1003.005 (Cached Domain Credentials), and T1003.001 (LSASS Memory). SAM and LSA registry access requires SYSTEM-level access on the target; the included remote methods also depend on an authorized admin-equivalent context and the relevant remote-management services. The steps are alternative implementations, not one sequential workflow. T1003.002 describes only the SAM portion, so this composite record needs a dependency-aware split.