value:  Turla has gathered credentials from the Windows Credential Manager tool. ;; Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.
name: Credentials from Password Stores: Windows Credential Manager