Been playing with this more, the memory dump contains session keys you can replay to bypass MFA, and client supplied certificates.