Search notes:

C:\ProgramData\Cyvera\LocalSystem\Persistence\agent_settings.db

PS:\> foreach ($m in get-content .\103951.ldb | select-string -allMatches '\bPassword\w.*') { $m.matches.value }

See also

C:\Program Files\Palo Alto Networks\Traps

Links

mr.d0x: Bypassing Cortext XDR

Index