value:  Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim including credentials used as part of Windows NTLM user authentication. 
name: OS Credential Dumping: Security Account Manager