Last updated 4 years ago
volatility image, use hashdump
Use crackstation to crack them, then cyberchef to hash them
volatility -f data --profile=Win7SP1x64 hashdump