Tag
Adversaries utilize PowerShell to copy the Security Account Manager (SAM) registry hive from shadow copies for offline credential extraction.