Volatility
vol.exe -f chall1.raw imageinfo vol.exe -f chall1.raw --profile Win7SP1x86 pslist vol.exe -f chall1.raw --profile Win7SP1x86 cmdscan vol.exe -f chall1.raw --profile Win7SP1x86 consoles vol.exe -f chall1.raw --profile Win7SP1x86 hashdump
ntlm login