Loading...
volatility image, use hashdump
volatility -f data --profile=Win7SP1x64 hashdump
Use crackstation to crack them, then cyberchef to hash them
https://gchq.github.io/CyberChef/#recipe=Sort('Line feed',false,'Alphabetical (case sensitive)')Find_/_Replace(%7B'option':'Extended (%5C%5Cn, %5C%5Ct, %5C%5Cx...)','string':'%5C%5Cn'%7D,' ',true,false,true,false)MD5()&input=c3VwZXJjb2xsaWRlcgphbnlvbmUgY2FuIHBsYXkgZ3VpdGFyCm15IGlyb24gbHVuZwprYXJtYSBwb2xpY2UKaWRpb3RlcXVlCnB5cmFtaWQgc29uZwp0aGVyZSwgdGhlcmUKd2VpcmQgZmlzaGVzL2FycGVnZ2kKbG90dXMgZmxvd2VyCmJ1cm4gdGhlIHdpdGNo