..
    generated, remove this comment to keep this file

``credhist.credhist``
=====================

.. code-block:: console

    $ target-query <path/to/target> -f credhist.credhist


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin``
    * - Output
      - ``records``

**Module documentation**

Windows CREDHIST file parser.

Windows XP:         ``C:\Documents and Settings\username\Application Data\Microsoft\Protect\CREDHIST``
Windows 7 and up:   ``C:\Users\username\AppData\Roaming\Microsoft\Protect\CREDHIST``

References:
    - https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#41

**Function documentation**

Yield and decrypt all Windows CREDHIST entries on the target.