For the given memory dump file $$mem$\_$p$10.$vmem$,$ you are asked to:

$$ Crack Rick$$s password. $($hint: if the password is too long, it$$s hard to crack the NTLM

hash. LM is empty if it is disabled for security reason. lsadump for Registry may

reveal some information. But how to verify that information is what you are after?$)$

$$ Find Rick$$s email password. Rick always forgets his email$$s password. So he uses an

online Stored Password Services and copy & paste the password when needed. $($hint:

check commands for GUI$)$

$2.$ The reason that we took Rick$$s PC memory dump $($mem$\_$p$10.$vmem$)$ is because there

was a malware infection. You are asked to find the malware process name $($including the

extension$).$

$($hint: check browser history using plugin chromehistory, process relevant plug$-$ins, cmdline,

etc.. helpful tutorial, cheet sheet, and$/$or volatility site.$)$