■■■□□ IMAP Password lying out there in Registry in DPAPI-encrypted form. Worth adding Seatbelt collection support? 🙂
HKLM\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Simple CryptUnprotectData() will do to decrypt it.
Source: https://twitter.com/mariuszbit/status/1527422972285403139
https://t.me/cKure/11374