May 21, 2022 at 02:55AM

■■■□□ IMAP Password lying out there in Registry in DPAPI-encrypted form. Worth adding Seatbelt collection support? 🙂

HKLM\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Simple CryptUnprotectData() will do to decrypt it.

Source: https://twitter.com/mariuszbit/status/1527422972285403139

https://t.me/cKure/11374