Password stealer and NTLM stealer modules in  harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.  has also executed  for further victim penetration.