Dump Cached Credentials
Advanced
🪟 Command Prompt (CMD)
reg query "HKLM\SECURITY\Cache"
💻 PowerShell
reg query "HKLM\SECURITY\Cache"
Show PowerShell History
Intermediate
🪟 Command Prompt (CMD)
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
💻 PowerShell
Get-Content (Get-PSReadLineOption).HistorySavePath
Show Browser History (Chrome)
Advanced
🪟 Command Prompt (CMD)
type "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History"
💻 PowerShell
# Chrome stores history in SQLite - use external tool to read Write-Host "Chrome history located at: $env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
Export Registry Key
Advanced
🪟 Command Prompt (CMD)
reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion backup.reg
💻 PowerShell
reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion backup.reg
Show Shadow Copies
Advanced
🪟 Command Prompt (CMD)
vssadmin list shadows
💻 PowerShell
Get-CimInstance Win32_ShadowCopy | Select-Object InstallDate, VolumeName, DeviceObject
No commands match