It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. It has also used tool named PICKPOCKET to dump passwords from web browsers.