Are credentials cached in LSA?

[Regnor]

I was wondering where Veeam Agent stores it's credentials for accessing SMB shares and/or Veeam repository.
And additionally are those credentials cached in the LSA?

Background: If I setup a dedicated account for accessing a SMB share, will a malware/Trojan be able to read those credentials? Especially credentials in the LSA would be easy to lookup for any kind of malware.

[Gostev]

The credentials are stored in the same manner as in B&R - in the configuration database, encrypted via CryptoAPI with machine-specific key.
And yes, if malware/trojan (or hacker) somehow gets root access to the server, it will be able to read and decrypt those credentials as well.

[Regnor]

Ok, I already thought that it was like this.
Thanks Anton.