Wmiprsve LOLBAS Execution Process Spawn
Windows Management Instrumentation
Windows Management Instrumentation
Credentials from Web Browsers, Credentials from Password Stores
Archive via Utility, Archive Collected Data
Create or Modify System Process, Windows Service
Remote Services, Windows Remote Management