Storage paths (protected and encrypted):

• %UserProfile%\\AppData\\Local\\Microsoft\\Vault\\
• %UserProfile%\\AppData\\Local\\Microsoft\\Credentials\\
• %UserProfile%\\AppData\\Roaming\\Microsoft\\Vault\\
• %ProgramData%\\Microsoft\\Vault\\
• %SystemRoot%\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Vault\\

It is possible to export Windows Vaults to .crd files, either via Control Panel or following command.

Backups are encrypted with a password supploed by the user, and can be imported on other Windows Systems.

rundll32 keymgr.dll,KRShowKeyMgr

Enumerate creds with cmdkey

cmdkey /list

Currently stored credentials:

    Target: WindowsLive:target=virtualapp/didlogical
    Type: Generic
    User: 02hejubrtyqjrkfi
    Local machine persistence

    Target: Domain:interactive=SRV01\\mcharles
    Type: Domain Password
    User: SRV01\\mcharles

With Mimikatz

privilege::debug
sekurlsa::credman

Writeup