IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: HKLM\SECURITY\Policy\PolEKList\default, HKLM\SECURITY\Policy\Secrets\*\CurrVal, and HKLM\SECURITY\Policy\Secrets\*\OldVal.