You can find the challenges here.

• Description

My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.

• Volatility Profile

I chose the first suggested profile Win7SP1x64 as this is a small raw image, and imageinfo plugin is accurate enough.

• Highlights

1 - Black popup tells me that I need to look into cmd.

2 - “Draw something” tells me that I should look into paint.

• Flag 1

I ran the consoles plugin on the image. It dumped the commands that was executed by cmd. Then, I found something unusual.

I decoded it and had the first flag.

flag{th1s_xxxxxxxxxxxx}

• Flag 2

This one is a bit tricky because we are trying to open some paint that was opened during the acquisition of the memory dump.

So, after searching a bit, it turns out that we can open a memory dump using photo editors. I used Gimp.

I dumped the process using the memdump plugin. Then, we need to rename 2424.dmp to ANY_NAME.data to allow Gimp to read it without any problem.

Loading the image to Gimp, then choosing RGB Alpha profile and playing with offset, width, height, and reversing the image, we are able to see the flag.

I wrote the flag down.

flag{G00d_BoY_xxxxxx}

• Flag 3

I actually found the 3rd flag when exploring the cmd.

I ran cmdline plugin and found something interesting.