PEAS
*evil-winrm* ps c:\Users\FSmith\Documents> upload winPEASany.exe C:\Users\FSmith\Documents\winPEASany.exe
info: Uploading winPEASany.exe to C:\Users\FSmith\Documents\winPEASany.exe
data: 2625536 bytes of 2625536 bytes copied
info: Upload successful!Delivery complete
Executing PEAS
AV
PEAS claims that there is no AV
KrbRelayUp
AutoLogon
PEAS was also able to pick up the AutoLogon credential
Hidden files/directories
the c:\Users\All Users\RICOH_DRV\RICOH Aficio SP 8300DN PCL 6 directory was already seen through the SMB enumeration earlier. It must be relevant to the installed printer