Populate well-known LUID usernames and improve session display

- Fill in SYSTEM/NETWORK SERVICE/LOCAL SERVICE usernames for well-known
  LUIDs when they're empty (common on VBox where WDigest is paged out)
- Ensures DPAPI-only sessions show meaningful identifiers

src/lsass/finder.rs

@@ -439,6 +439,19 @@ pub fn extract_all_credentials<P: PhysicalMemory>(
         }
     }
 
+    // Fill in well-known LUID names when username/domain are empty
+    // (happens when session was created by DPAPI/other provider without WDigest discovery)
+    for cred in all_creds.values_mut() {
+        if cred.username.is_empty() {
+            match cred.luid {
+                0x3e7 => { cred.username = "SYSTEM".to_string(); }
+                0x3e4 => { cred.username = "NETWORK SERVICE".to_string(); }
+                0x3e5 => { cred.username = "LOCAL SERVICE".to_string(); }
+                _ => {}
+            }
+        }
+    }
+
     let mut result: Vec<Credential> = all_creds.into_values().collect();
     result.sort_by_key(|c| c.luid);
     Ok(result)