/posts/how-to-pass-the-hash-by-yourself/
Sekurlsa - 如何滥用 CreateProcessWithLogonW 函数实现哈希传递 - WHOAMI