Enumeration

*Evil-WinRM* PS C:\Users\Administrator\Scripts> dir


    Directory: C:\Users\Administrator\Scripts


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         5/25/2023  10:20 AM           8704 PassCheckLib.dll
-a----         5/26/2023   8:12 AM          24064 PasswordCheck.exe
-a----         5/25/2023   7:54 AM        1608128 System.Management.Automation.dll

strings -e l PasswordCheck.exe
P@ssw0rd
riley
!QAZ1qaz
web_svc
PassCheckLib.dll
PassCheckLib.PassCheck
v4.0.30319
NeedsChange
ResetPassword

They're probably nothing of our concern. I think these scripts are used to automate creating users and giving them passwords on the box.