@inetopenurla If you can get a memory dump you can use Volatility to do this for all currently running shells. Otherwise, no hope.