What the password?mimikatz一把梭了password ：MortyIsReallyAnOtter2 - General Infovol.py -f OtterCTF.vmem --profile=Win7SP1x64 netscan
找到ip上题的PC名称就是答案3 - Play Time用pslist查看进程可以过滤一下产看ip
ip：77.102.199.1024 -
https://otterctf.com/Memory Forensics1 - What the password?you got a sample of rick’s PC’s memory. can you get his user password? format: CTF{…}Alternative download link: https://mega.nz/#!sh8wmCIL!b4
10 - Bit 4 BitWe’ve found out that the malware is a ransomware. Find the attacker’s bitcoin address.恶意软件其实是一个赎金软件，需要从中找到钱包地址。先把恶意文件给dump出来python vol.py -f OtterCTF.vmem --profile=Win7SP1x64 procdump -
查看文件内容base64解密后可以找到一个邮箱：song552085107@qq.com在 GitHub 上查找，有一个相关用户进入项目，根据README.md文件提示，将__APP__文件下载下来在__APP__文件中可以找到一串字符串： U2FuZ0ZvcntTMF8zYXp5XzJfY3JhY2tfbm9vYl9wbGF5ZXJ9base64解码后得到flag[OtterCTF 2018]W
