Now we are aware of dumping credentials in memory and running tools on the OS host, but we have offline methods as well, where the operator can dump the lsass process and attack the file offline. One tool that allows us this is the Task Manager itself, it will create a Dumps' file of the process for inspection, but we can grab this file and attack it offline