killchain-compendium/post_exploitation/docs/powershell.md

# Powershell

## HashDump
```sh
save HKLM\SAM C:\Users\Administrator\Desktop\SAM
save HKLM\SAM C:\Users\Administrator\Desktop\System
```
* Use `samdump2`