It has gained access to credentials via exported copies of the ntds.dit Active Directory database. It has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.