Rundll32 LockWorkStation
System Binary Proxy Execution, Rundll32
System Binary Proxy Execution, Rundll32
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
NTDS, OS Credential Dumping
Security Account Manager, OS Credential Dumping
Credentials from Password Stores, Credentials from Web Browsers