rdpcache

$ target-query <path/to/target> -f rdpcache

Details

Module	dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin
Output	records

Module documentation

Plugin to extract the RDP Bitmap Cache from a Windows target.

References:

• https://www.cert.ssi.gouv.fr/actualite/CERTFR-2016-ACT-017/

Function documentation

This is a namespace plugin. This means that by running this plugin, it will automatically run all other plugins under this namespace:

• rdpcache.paths

• rdpcache.recover