You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As more malware is using Data Protection API (DPAPI) to encrypt/decrypt their payloads, it would be useful to collect these DPAPI keys in acquire. These paths are:
As more malware is using Data Protection API (DPAPI) to encrypt/decrypt their payloads, it would be useful to collect these DPAPI keys in acquire. These paths are:
\Windows\System32\Microsoft\Protect\
\Users\\*\AppData\Roaming\Microsoft\Protect\
\Users\\*\Application Data\Microsoft\Protect\
See also:
https://github.com/fox-it/dissect.target/blob/main/dissect/target/plugins/os/windows/dpapi/dpapi.py#L50-L63
The text was updated successfully, but these errors were encountered: