ar-win-2.attackrange.local Administrator "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\vmcjfqdn\vmcjfqdn.cmdline" cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESAC69.tmp" "c:\Users\Administrator\AppData\Local\Temp\vmcjfqdn\CSCF1AEBBE652C544BBBF2DDE44CF25F4E6.TMP"