Quick Examples
Browse All Commands
How ViperShell Works
Just type what you want to do in plain English and hit Generate. ViperShell will give you the right PowerShell script to copy and paste into your terminal. No scripting knowledge needed.
What happens when you type something
1. You describe what you need (e.g. "show disk space")
2. If the script needs extra info (like a folder path or drive letter), a popup will ask you to fill it in
3. The completed script appears with syntax highlighting — click Copy to copy it
4. Paste it into PowerShell and press Enter
Tips for better results
You can include details in your request to skip the popup and get a more specific script:
• Include a location: "find large files in downloads" or "list files in C:\Projects"
• Include a size: "find files larger than 500mb"
• Include a time: "show errors from last 4 hours" or "find files older than 30 days"
• Include a name: "restart a service" or "ping 8.8.8.8" — you'll be prompted if one is needed
• Include a count: "show top 5 processes by memory"
All Commands by Category
File Operations
Work with files and folders — find, list, copy, move, delete, and inspect them.
| What to type | What it does |
|---|---|
| "find large files in C:\" | Finds files over 100MB (or specify a size like "larger than 500mb") |
| "find old files in documents" | Finds files not modified recently (default: 7+ days old) |
| "find recent files in downloads" | Shows files changed in the last 7 days |
| "list files in desktop" | Shows everything in a folder with sizes and dates |
| "list folders in C:\" | Shows only folders (no files) |
| "copy pdf files from downloads to documents" | Copies files matching a type between folders |
| "move jpg files from downloads to pictures" | Moves files from one folder to another |
| "delete old files in temp" | Deletes files older than N days (uses safety mode by default) CAUTION |
| "show folder sizes in C:\" | Shows how much space each subfolder uses |
| "show permissions on downloads" | Shows who has access to a folder |
| "hash files in documents" | Generates SHA256 checksums for file verification |
| "find locked files" | Shows which files are being held open by programs |
System Status
Check your computer's health — CPU, memory, disk, what's installed, and more.
| What to type | What it does |
|---|---|
| "show cpu usage" | Shows current CPU load percentage |
| "what's eating cpu" | Shows the top programs using the most CPU |
| "show memory usage" | Shows total, used, and free RAM |
| "what's using memory" | Lists top programs by memory consumption |
| "show disk space" | Shows free/used space on all drives |
| "show running processes" | Lists all running programs with memory and CPU info |
| "kill process chrome" | Force-stops a specific program CAUTION |
| "show uptime" | Shows how long since the computer was last restarted |
| "show system info" | Shows computer name, OS version, RAM, and last boot time |
| "show installed software" | Lists all programs installed on this computer |
| "show installed updates" | Lists Windows updates/patches with install dates |
| "show drivers" | Lists third-party (non-Microsoft) device drivers |
| "show environment variables" | Shows all system environment variables (PATH, etc.) |
| "check pending reboot" | Tells you if the computer needs a restart |
Services
Windows services are background programs (like Print Spooler, Windows Update, etc.).
| What to type | What it does |
|---|---|
| "list all services" | Shows every service and whether it's running or stopped |
| "show running services" | Shows only services that are currently active |
| "show stopped services" | Shows services that aren't running |
| "stopped services that should be running" | Shows services set to Auto-start that have stopped |
| "check status of a service" | Checks whether a specific service is running (you'll be asked which one) |
| "restart a service" | Stops and restarts a service (you'll be asked which one) ADMIN |
| "stop a service" | Stops a specific service (you'll be asked which one) ADMIN |
| "start a service" | Starts a stopped service (you'll be asked which one) ADMIN |
Logs & Events
Windows keeps a diary of everything that happens. These commands help you read it.
| What to type | What it does |
|---|---|
| "show recent errors" | Shows recent error and critical events from system logs |
| "show errors from last 4 hours" | Same but filtered to a specific time window |
| "show failed logon attempts" | Shows who tried to log in and failed ADMIN |
| "show security log" | Shows security audit events (logins, access, etc.) ADMIN |
| "show system log" | Shows system-level events (drivers, hardware, etc.) |
| "show application log" | Shows application errors and warnings |
| "show powershell log" | Shows PowerShell script execution events |
| "show account changes" | Shows when user accounts were created, deleted, or modified ADMIN |
| "show recent software installs" | Shows what software was recently installed via MSI |
Network
See what your computer is connected to, what ports are open, and test connectivity.
| What to type | What it does |
|---|---|
| "show active connections" | Shows all current network connections and which programs made them |
| "show open ports" | Shows which ports are listening for connections |
| "check port 443" | Checks what's using a specific port |
| "show ip config" | Shows your IP address, gateway, and DNS servers |
| "show dns cache" | Shows recently looked-up domain names |
| "flush dns cache" | Clears the DNS cache (fixes some connection issues) ADMIN |
| "ping 8.8.8.8" | Tests if you can reach a server or IP address |
| "show firewall rules" | Lists active Windows Firewall rules ADMIN |
| "show smb shares" | Shows shared folders on this computer ADMIN |
| "show arp table" | Shows devices on your local network (IP to MAC mapping) |
| "show routing table" | Shows how network traffic is being routed |
| "show wifi profiles" | Shows saved WiFi networks and their passwords ADMIN |
| "reset network" | Flushes DNS, renews IP, and resets Winsock ADMIN |
Persistence Hunting
Check for programs that automatically start when Windows boots — useful for finding unwanted software or malware.
| What to type | What it does |
|---|---|
| "show registry run keys" | Shows programs set to launch via registry autorun entries |
| "show scheduled tasks" | Lists active scheduled tasks and what they run |
| "show suspicious scheduled tasks" | Shows tasks running from unusual locations |
| "show services from non-standard paths" | Finds services running from outside Windows/System32 |
| "show startup folders" | Shows what's in the Windows Startup folders |
| "show wmi event subscriptions" | Checks for WMI-based persistence (advanced malware technique) ADMIN |
| "check image file execution options" | Checks for IFEO debugger hijacks |
| "find alternate data streams" | Finds hidden data streams attached to files |
| "show named pipes" | Lists active named pipes (used for inter-process communication) |
Users & Accounts
See who has access to this computer and manage account information.
| What to type | What it does |
|---|---|
| "list local admins" | Shows who has administrator access |
| "list local users" | Shows all user accounts on this computer |
| "who is logged in" | Shows currently active user sessions |
| "show local groups" | Lists all groups and how many members each has |
| "show locked accounts" | Shows accounts that are locked out (too many bad passwords) |
| "show password policy" | Shows password rules (length, expiry, lockout threshold) |
Security Posture
Check how well-protected this computer is.
| What to type | What it does |
|---|---|
| "show defender status" | Shows if Windows Defender antivirus is on and up to date |
| "show defender exclusions" | Shows what's excluded from antivirus scanning ADMIN |
| "show bitlocker status" | Shows if drives are encrypted ADMIN |
| "show audit policy" | Shows what Windows is logging/auditing ADMIN |
| "show share permissions" | Shows network shares accessible by Everyone ADMIN |
Forensics & Incident Response
Investigate what happened on a computer — what ran, what was connected, what changed.
| What to type | What it does |
|---|---|
| "show usb device history" | Shows USB drives/devices that have been plugged in |
| "show prefetch files" | Shows evidence of which programs have been executed ADMIN |
| "show powershell command history" | Shows previously typed PowerShell commands |
| "show recent executables" | Finds .exe files recently created in user folders |
| "show hosts file" | Checks for DNS overrides (malware sometimes modifies this) |
| "show temp folder contents" | Shows what's sitting in temporary folders |
| "show recycle bin contents" | Shows recently deleted files |
| "show loaded dlls for chrome" | Shows what libraries a specific program has loaded |
| "show unsigned processes" | Finds running programs without valid digital signatures |
Active Directory
For computers joined to a company network/domain. These will show a friendly message if you're not on a domain.
| What to type | What it does |
|---|---|
| "show domain info" | Shows which domain this computer belongs to |
| "show domain controllers" | Lists the servers managing the domain |
| "show domain admins" | Lists users with domain-wide admin access |
| "show domain users" | Lists all user accounts in the domain |
| "show applied GPOs" | Shows Group Policy settings applied to this computer |
| "show domain trusts" | Shows trust relationships with other domains |
| "check for service principal names" | Finds accounts with SPNs (security audit check) |
Maintenance
Keep your computer running smoothly with cleanup, repair, and update tools.
| What to type | What it does |
|---|---|
| "empty recycle bin" | Permanently deletes everything in the Recycle Bin CAUTION |
| "run disk cleanup" | Clears temp files, thumbnails, and caches to free space CAUTION |
| "clear event logs" | Wipes Application, System, and Setup logs ADMIN CAUTION |
| "optimize drive C" | Defragments a hard drive or TRIMs an SSD ADMIN |
| "check disk health on C" | Scans a drive for errors (read-only, safe) ADMIN |
| "run system file checker" | Scans Windows for corrupted system files (sfc /scannow) ADMIN |
| "check windows component health" | DISM scan of Windows image health ADMIN |
| "repair windows image" | DISM repair of corrupted Windows components ADMIN |
| "check for windows updates" | Checks for available updates (or opens Windows Update) ADMIN |
| "remove update KB5034441" | Uninstalls a specific Windows update ADMIN CAUTION |
| "clear print queue" | Fixes stuck print jobs by clearing the queue ADMIN |
| "restart explorer" | Restarts Windows Explorer (fixes frozen taskbar/desktop) |
| "reset network" | Flushes DNS, renews IP address, resets Winsock ADMIN |
Good to Know
What does "Run as Administrator" mean?
Some scripts need elevated permissions. Right-click PowerShell in your Start menu and choose "Run as Administrator". You'll see scripts that need this marked with ADMIN.
What is the -WhatIf safety?
Delete commands include -WhatIf by default. This means the script will show you what it would delete without actually deleting anything. Once you've reviewed the list and you're sure, edit the script to remove -WhatIf and run it again.
Known folder shortcuts
You can use plain names for common folders and ViperShell will figure out the path:
desktop • downloads • documents • pictures • music • videos • temp • appdata • programfiles