Windows caches the logons of the last few users as a hash on the local PC, malware can use those hashes to authenticate against network resources as that user.

Windows caches the logons of the last few users as a hash on the local PC, malware can use those hashes to authenticate against network resources as that user. If one of those users was a domain admin, on most networks they can access just about anything