Windows Credential Manager
Command and Scripting Interpreter
Credentials from Web Browsers
Credentials from Password Stores
Process Discovery
System Network Configuration Discovery
Symmetric Cryptography
Query Registry
Web Protocols
System Owner/User Discovery
Windows Management Instrumentation
Data from Local System
Exfiltration Over C2 Channel
PowerShell
Scheduled Task
System Information Discovery