@iWillBeFamous said:
Winpeas didn’t find it since,
I find winpeas is hit and miss at the best of times. I’ve never been a big fan of it. On HTB it wont work on about 50% of the boxes and in real life I’ve found it tends to be pretty untrustworthy.
Like I get it , but it’s not fun to look for hidden files everywhere on the system.
You don’t need to look everywhere. Looking for files related to automation is good practice and should be one of the first steps for enum. A single PowerShell command achieves this really quickly.