From a0fa19236bb227ec684fd0319785c04260d6a040 Mon Sep 17 00:00:00 2001
From: Lee Chagolla-Christensen <lee@localhost>
Date: Fri, 10 Oct 2025 19:05:48 -0700
Subject: [PATCH] fix missing MasterKey arg

---
 .../file_enrichment_modules/lsass_dump/analyzer.py             | 3 ++-
 projects/file_enrichment/file_enrichment/routes/dpapi.py       | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py b/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py
index 33fec20..541ae57 100644
--- a/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py
+++ b/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py
@@ -12,7 +12,7 @@ from common.state_helpers import get_file_enriched
 from common.storage import StorageMinio
 from dapr.clients import DaprClient
 from file_enrichment_modules.module_loader import EnrichmentModule
-from nemesis_dpapi import DpapiManager, MasterKey
+from nemesis_dpapi import DpapiManager, MasterKey, UserAccountType
 from pypykatz.pypykatz import pypykatz
 
 if TYPE_CHECKING:
@@ -241,6 +241,7 @@ class LsassDumpParser(EnrichmentModule):
 
                             mk = MasterKey(
                                 guid=UUID(str(cred.key_guid)),
+                                user_account_type=UserAccountType.UNKNOWN,
                                 plaintext_key=masterkey_bytes,
                                 plaintext_key_sha1=sha1_masterkey_bytes,
                             )
diff --git a/projects/file_enrichment/file_enrichment/routes/dpapi.py b/projects/file_enrichment/file_enrichment/routes/dpapi.py
index 3e76b96..18fd1a9 100644
--- a/projects/file_enrichment/file_enrichment/routes/dpapi.py
+++ b/projects/file_enrichment/file_enrichment/routes/dpapi.py
@@ -31,6 +31,7 @@ from nemesis_dpapi import (
     Password,
     Pbkdf2Hash,
     Sha1Hash,
+    UserAccountType,
 )
 from nemesis_dpapi.eventing import (
     DpapiEvent,
@@ -245,6 +246,7 @@ async def _handle_master_key_guid_pairs(dpapi_manager: DpapiManager, request: Ma
 
         masterkey = MasterKey(
             guid=masterkey_guid,
+            user_account_type=UserAccountType.UNKNOWN,
             plaintext_key=masterkey_data,
             plaintext_key_sha1=SHA1.new(masterkey_data).digest(),
         )