- Fast response in wmi query (switch to execute vbs) -- Done
- More customized configuration
- Wmi class derived
- Hashdump shadowcopy & regsecret -- Done
- Modify service
- SMB takeover