In modern Windows, cached hashes are stored in memory in LSASS (Local Security Authority Subsystem Service). LSASS runs as SYSTEM and SYSTEM/local admin privileges are needed to retrieve the cached hashes. The in-memory cache data structure is undocumented and encrypted with a key. Tools like Mimikatz can retrieve these credentials given enough privilege.