Solved! I'll post a detailed how-to sometime in the next days.

Hello BCT community. I recently created a wallet, got a shielded address, closed the wallet and sent ZEC to the address. The amount is not important, but its alot. Upon opening the wallet to verify the receipt, nothing showed up. QT says wallet corrupted. I closed it the usual way of waiting for the window to dissappear. I did not bother with the wallet.dat file while the QT was running. I made a RAM dump both on the process and the entire memory. Opened in hex, i am finding entries like "sapzkey". I assume that private key is hiding somewhere there. My question is, how do i find out exactly which bytes are the actual private key, and how do i convert it to WIF.

Address format zs1ym6x5cv3u99zrwfwzkqlyf62w5f8p80hac6002r2vlyldx5hrgh3h6wss8fgp53cxhynktk35mh

Private key format secret-extended-key-main1q0slqqjfqqqqpqz7tx45xjzxghy48mdukf8tsddj8w22plrlasvry8796umkgvnr97q86k2hw32f9ewj07n4yz0azakxz8kxadkujsa60apejc2zl3kqjd6hyrtu9lywauhhvqzx4329zl9rg6fn3vssylywx6q2egdn5nqvrunavg7pwpgmkj6ap2jpemw3ghahynatmzcmrja0596g6x3492kmj8edra0dp3uw2m7ezdpmtphjcwgzp8nk346hjj3fpqd87hy0fxghnq582

The address above is dummy, so do not bother checking for balance.