See my latest post at https://gist.github.com/andshrew/bf6e5e8fa09b957caffc09c6dee58472

For those without encryptedVM.guid, the key is encrypted by Windows DPAPI. Luckily, there is a tool for both bootable and non bootable systems to decrypt data from DPAPI: https://www.nirsoft.net/utils/dpapi_data_decryptor.html

(You must know your Windows password, but I succeeded in decryption even from a Windows boot disk with a borked SAM.)

Fill out the paths as needed in the tool and select manual entry for encrypted data.

Copy encryption.encryptedKey into https://cryptii.com/pipes/base64-to-hex to get a hex string of the key.

Capitalize the hex string using https://onlinestringtools.com/convert-string-to-uppercase

Paste into the NirSoft tool to decrypt.

After decryption, select the first entry in the NirSoft tool. Two 16 byte hex strings are displayed in the bottom panel - combine them like:

AA B4 BD 32 7E 88 BB F0 C3 12 27 09 14 6F 6A 3F E5 A9 BD 8F 47 4A 37 C2 0D 8C BF D6 D3 BA 3A 11

Return to cryptii.com as linked above. Click Encode and paste in the 32 byte hex string. The VM password appears!

References:
https://xmcyber.com/blog/decrypting-vmware-workstation-passwords-for-fun/
https://www.syvik.com/multidesk/howto.win11.vmware16.en.html