PoC of dumping hashes, filtering for the Administrator hash and exfiltration via keystroke reflection. Bring some time, this may take a while :) Disclaimer: On recent versions of Windows, this will result in an empty/default hash.