It has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. It has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.