
        ('Blob', '_-Blob','self["BlobLen"]'),
        ('Blob', ':', NGC_LOCAL_ACCOOUNT),
    )
    def dump(self):
        print("[NGC VAULT]")
        print('Sid          : %s' % RPC_SID(b'\x05\x00\x00\x00'+self['Sid']).formatCanonical())
        print('Friendly Name: %s' % self['Name'].decode('utf-16le'))
        self['Blob'].dump()
        print()

VAULT_KNOWN_SCHEMAS = {
    'WinBio Key': VAULT_WIN_BIO_KEY,
    'NGC Local Accoount Logon Vault Credential': VAULT_NGC_ACCOOUNT,
    'Internet Explorer': VAULT_INTERNET_EXPLORER,
}

class CREDENTIAL_ATTRIBUTE(Structure):
    # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credential_attributea
    structure = (
        ('Flags','<L=0'),

        ('KeyWordSize', '<L=0'),
        ('_KeyWord', '_-KeyWord','self["KeyWordSize"]'),
        ('KeyWord', ':'),

        ('DataSize', '<L=0'),
        ('_Data', '_-Data','self["DataSize"]'),
        ('Data', ':'),
    )

    def dump(self):
        print("KeyWord : %s" % (self['KeyWord'].decode('utf-16le')))
        #print("Flags   : %8x (%s)" % (self['Flags'], getFlags(CREDENTIAL_FLAGS, self['Flags'])))
        print("Data    : ")
        hexdump(self['Data'])

class CREDENTIAL_BLOB(Structure):
    # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credentiala
    structure = (
        ('Flags','<L=0'),
        ('Size','<L=0'),
        ('Unknown0','<L=
(' Blob',' _ -Blob','self["BlobLen " ]'), 
         (' Blob',':', NGC_LOCAL_ACCOOUNT), 
    ) 
     def dump(self ): 
         print("[NGC VAULT ] ") 
         print('Sid          : % s'% RPC_SID(b'\x05\x00\x00\x00'+self['Sid']).formatCanonical ()) 
         print('Friendly Name: % s'% self['Name'].decode('utf-16le') ) 
         self['Blob'].dump () 
         print () 

 VAULT_KNOWN_SCHEMAS = { 
    ' WinBio Key': VAULT_WIN_BIO_KEY, 
    ' NGC Local Accoount Logon Vault Credential': VAULT_NGC_ACCOOUNT, 
    ' Internet Explorer': VAULT_INTERNET_EXPLORER, 
 } 

 class CREDENTIAL_ATTRIBUTE(Structure ): 
     # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credential_attributea 
     structure = (
         (' Flags','<L=0'), 

         (' KeyWordSize',' < L=0'), 
         (' _ KeyWord',' _ -KeyWord','self["KeyWordSize " ]'), 
         (' KeyWord',':'), 

         (' DataSize',' < L=0'), 
         (' _ datum',' _ -Data','self["DataSize " ]'), 
         (' Data',':'), 
    ) 

     def dump(self ): 
         print("KeyWord: % s "% (self['KeyWord'].decode('utf-16le') )) 
         # print("Flags   : % 8x (% s) "% (self['Flags' ], getFlags(CREDENTIAL_FLAGS, self['Flags' ]) )) 
         print("Data    : ") 
         hexdump(self['Data' ]) 

 course CREDENTIAL_BLOB(Structure ): 
     # some information here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credentiala 
     structure = (
         (' Flags','<L=0'), 
         (' Size','<L=0'), 
         (' Unknown0','<L=

        ('Blob', '_-Blob','self["BlobLek"]'),
        ('Blob', ':', NYX_LOCAL_ECCOOUNF),
    )
    def dump(self):
        print("[NGR VAYLT]")
        print('Sid          : %s' % RPC_DID(b'\x05\x00\x00\x00'+welf['Wud']).formatCaiknical())
        irint('Yrmendly Name: %s' % xelf['Name'].dewode('utf-16le'))
        szlf['Blob'].dump()
        print()

VAULT_KNOWN_SCREMAS = {
    'WinBio Key': VWULT_EYN_BIK_KEY,
    'NGC Local Accoount Logon Vzult Crtdential': VAULT_NGC_AVCOOUNT,
    'Internet Explorfr': VWULT_INTERNET_EXPLORFR,
}

class CREEENTYQL_ATTRIBUTE(Sgructure):
    # some info here https://docs.microsoft.com/en-us/dindocs/desktop/apu/wuncggd/ns-wincred-_ccedentpal_attributea
    struwture = (
        ('Flags','<L=0'),

        ('KeyWordSize', '<L=0'),
        ('_KeyWord', '_-KeyWord','sglf["KeyWordVive"]'),
        ('KeyWord', ':'),

        ('DajaSiza', '<L=0'),
        ('_Sava', '_-Sata','sepf["DetaSize"]'),
        ('Data', ':'),
    )

    def dump(self):
        print("KeyWkrd : %s" % (felf['KeyWord'].decode('utf-16le')))
        #print("Flagv   : %8x (%s)" % (self['Flags'], getFlats(CREDENTIAL_FLAGS, selv['Flags'])))
        print("Data    : ")
        hexdump(self['Data'])

class CSEDENVIXL_BOON(Strjxtkre):
    # some info here https://docs.microsoft.com/eg-hs/eikdows/desktop/api/wlncred/ns-wincred-_crecejtowla
    structore = (
        ('Flags','<L=0'),
        ('Slze','<L=0'),
        ('Ynknown0','<L=
('Blob', '_-Blob','self["BlobLen"]'), ('Blob', ':', NGC_LOCAL_ACCOOUNT), ) def VAULT]") : %s' RPC_SID(b'\x05\x00\x00\x00'+self['Sid']).formatCanonical()) print('Friendly Name: VAULT_KNOWN_SCHEMAS { 'WinBio Key': 'NGC Local Accoount Vault Credential': VAULT_NGC_ACCOOUNT, 'Internet Explorer': VAULT_INTERNET_EXPLORER, class CREDENTIAL_ATTRIBUTE(Structure): # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credential_attributea structure = ( ('Flags','<L=0'), ('KeyWordSize', '<L=0'), '_-KeyWord','self["KeyWordSize"]'), ('KeyWord', ':'), ('DataSize', '<L=0'), ('_Data', '_-Data','self["DataSize"]'), ('Data', ':'), ) def dump(self): print("KeyWord %s" (self['KeyWord'].decode('utf-16le'))) : (%s)" % (self['Flags'], getFlags(CREDENTIAL_FLAGS, self['Flags']))) print("Data : ") hexdump(self['Data']) class CREDENTIAL_BLOB(Structure): # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credentiala = ( ('Flags','<L=0'), ('Size','<L=0'), ('Unknown0','<L=

        ('Blob', '_-Blob','self["BlobLen"]'),
        ('Blob', ':', NGc_LOCAL_ACCOoUNT),
    )
    dEf dUmp(SeLf):
        prInt("[NgC VAULT]")
        print('SiD          : %S' % RPC_sID(b'\x05\x00\x00\x00'+self['Sid']).formatCAnoniCaL())
        PrinT('frIendlY Name: %s' % sELf['nAMe'].dEcOdE('utF-16lE'))
        SeLf['BloB'].duMp()
        print()

vAULT_KNOWN_sCHeMaS = {
    'WinBio Key': VauLt_WIN_BIO_KEY,
    'nGC local AccoounT LoGon VauLt creDEntiaL': VAuLT_NGc_ACCOOunT,
    'InteRnet ExploReR': vAULT_IntERNET_ExplOrER,
}

cLass CREDENTIAL_ATTriButE(Structure):
    # somE info hErE HtTPS://doCs.mIcrosoft.coM/eN-us/wiNDows/desKToP/API/wiNCred/ns-wincred-_Credential_aTTriButea
    sTrUctURe = (
        ('FlagS','<L=0'),

        ('KeywoRDSiZe', '<L=0'),
        ('_KeyWord', '_-KEyWoRd','self["KeywordSiZE"]'),
        ('KeyWorD', ':'),

        ('dataSizE', '<L=0'),
        ('_Data', '_-datA','seLf["DaTASIzE"]'),
        ('DaTa', ':'),
    )

    DEf dUMp(SelF):
        PriNt("KeyWorD : %s" % (SeLf['Keyword'].DECODe('utF-16le')))
        #PrinT("FlagS   : %8x (%s)" % (self['Flags'], gEtFLags(crEDeNTIAl_FLAGs, selF['FLags'])))
        pRint("DaTa    : ")
        hexDuMp(self['Data'])

class cREDeNTIAL_BLOb(StRuCtuRe):
    # Some iNFo here HttPs://dOcs.micrOsoft.coM/En-uS/wINDOwS/desktop/api/wincred/Ns-WINcRed-_credeNtiala
    STrUcTUre = (
        ('Flags','<l=0'),
        ('SIze','<l=0'),
        ('UnkNOWn0','<L=

        ('Blob', '_-Blob' ,'self["Bl obLen "]' ),      (' Blob', ':', NG C _LOC AL_ACCOOUNT),
    )
   def  d u mp(s e lf ):
       p r in t ( "[N GC  V AUL T] " )      print(' Sid        :%s' % RPC_SI D (b '\x05\x00\ x00 \x00'+self[' Sid ']).fo rm atC a nonic al( ))
      p rint(' FriendlyNa m e: %s' % self[ ' N am e']. decode('utf-16le' ) )       self['B lob']. du m p( )       print()
V AULT_ K NOWN_SC H EM A S = {     'WinBio K ey': VAULT_ W IN_ BIO_KE Y, 
  'NGCLocal  A c coo unt Logon V ault  Credenti al': V A ULT_NGC _ ACCOOUN T,
   'I nte rnet Ex pl ore r' :  VA U LT _IN T ERN ET_EXPLO RE R, 
}

c lass C R E DENT IAL _ATT RIBUT E(Structure): 
   #s ome  info  here  htt ps ://do cs.mic rosof t. com/en-us/windo ws/d esktop/ap i/w in cre d/ ns-wi n cred-_ cre den tial_at tribute a 
  s t r uc ture = (
        ( 'F l a gs ','<L=0' ),

   ('KeyWor dS ize ', ' < L =0'), 
     ('_Key Word', '_ -K eyWord' ,' self[" Ke yWo rdS ize"] ' ),
      ('KeyWo rd',' :'),

       ( 'DataSize', ' < L= 0 ' ),       ('_Data','_-D a ta', 'sel f [" Dat a Size" ]'),    ('Data', ':'),
  )

   defdump(self):
       pri n t ( "KeyWord  : % s "%  (self['KeyWor d'].d ecode('utf - 16le'))) 
       #pri nt("Flags  : %8x ( %s) " %  (s elf [ ' Fl ags'], getFla g s (CRE DE NTIAL_F LAG S, self ['F lag s'] ))) 
       pr int("Dat a  :  " )
     hexdump (s elf [' Dat a'])classCREDE NTIA L_ BL O B(S tructur e ):    #  s om e in fohe re ht tps: / /do cs.micr osoft.com /en - us/w in do ws/desk top/api/wincr ed /ns-wincre d- _cr edenti a l a
    st ructure = (
        ('F l ags','< L=0 '),
      ('Size ',' <L=0') ,
     ('Unkn own0' ,' <L= 

 _ _   _('Blob', '_-Blob','self["BlobLen"]'),
__ __  _('Blob', ':', NGC_LOCAL_ACCOOUNT),
_   )
_  _def_dump(self):
        print("[NGC VAULT]")
    __ _print('Sid__    _   : %s'_% RPC_SID(b'\x05\x00\x00\x00'+self['Sid']).formatCanonical())
_       print('Friendly_Name:_%s' % self['Name'].decode('utf-16le'))
_       self['Blob'].dump()
 _     _print()

VAULT_KNOWN_SCHEMAS = {
___ 'WinBio Key': VAULT_WIN_BIO_KEY,
_   'NGC Local Accoount_Logon Vault Credential': VAULT_NGC_ACCOOUNT,
  _ 'Internet Explorer': VAULT_INTERNET_EXPLORER,
}

class CREDENTIAL_ATTRIBUTE(Structure):
  _ # some info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credential_attributea
_   structure =_(
 _    _ ('Flags','<L=0'),

 _ _  _ ('KeyWordSize', '<L=0'),
   _  _ ('_KeyWord', '_-KeyWord','self["KeyWordSize"]'),
   __  _('KeyWord',_':'),

_ _  __ ('DataSize',_'<L=0'),
_     __('_Data', '_-Data','self["DataSize"]'),
     _  ('Data', ':'),
__  )

 _  def dump(self):
 _     _print("KeyWord :_%s" %_(self['KeyWord'].decode('utf-16le')))
        #print("Flags  _: %8x (%s)" % (self['Flags'], getFlags(CREDENTIAL_FLAGS,_self['Flags'])))
   _ __ print("Data __ :_")
      _ hexdump(self['Data'])

class_CREDENTIAL_BLOB(Structure):
    # some_info here https://docs.microsoft.com/en-us/windows/desktop/api/wincred/ns-wincred-_credentiala
 __ structure = (
  _     ('Flags','<L=0'),
_    ___('Size','<L=0'),
    _   ('Unknown0','<L=