The Security Account Manager (SAM) stores the NTLM hashes of local users.