Providing the MD5 hash or the platform name would help in giving you the exact steps for that specific challenge.
Look for unusual files in the process memory that might contain a flag. 4. Flag Discovery bluescreen.rar
python vol.py -f dump.raw --profile=Win7SP1x64 pslist (Looking for suspicious or hidden processes). Providing the MD5 hash or the platform name
