mimikatz can decrypt DPAPI with masterkey:
dpapi::blob /in:"test" /masterkey:X /unprotectXXX
How can I dump the masterkey and do the decrypt job offline?