# Windows Pains 2![Category](http://img.shields.io/badge/Category-Forensics-orange?style=for-the-badge) ![Points](http://img.shields.io/badge/Points-50-brightgreen?style=for-the-badge)
## Details
One of De Monne's employees had their personal Windows computer hacked by a member of DEADFACE. The attacker managed to exploit a portion of a database backup that contains sensitive employee and customer PII.
> Using the [memory dump file](https://tinyurl.com/wcekj3rt) from Window Pains, submit the victim's computer name.>> Submit the flag as `flag{COMPUTER-NAME}`.---
Using Volatility3  we run `sudo python3 vol.py -f physmemraw windows.envars | grep "COMPUTERNAME"   `
```❯ sudo python3 /opt/volatility3/vol.py -f physmemraw windows.envars | grep "COMPUTERNAME"568gresswininit.exe     0x2760e6015c0canCOMPUTERNAME    DESKTOP-IT8QNRI644     winlogon.exe    0x2a6290a15c0   COMPUTERNAME    DESKTOP-IT8QNRI668     services.exe    0x18faf803120   COMPUTERNAME    DESKTOP-IT8QNRI708     lsass.exe       0x23442203120   COMPUTERNAME    DESKTOP-IT8QNRI832     svchost.exe     0x1e39d603300   COMPUTERNAME    DESKTOP-IT8QNRI952     svchost.exe     0x1c6c2e03390   COMPUTERNAME    DESKTOP-IT8QNRI996     svchost.exe     0x2da88203300   COMPUTERNAME    DESKTOP-IT8QNRI428     dwm.exe 0x19f91801910   COMPUTERNAME    DESKTOP-IT8QNRI1044    svchost.exe     0x26318003390   COMPUTERNAME    DESKTOP-IT8QNRI1116    svchost.exe     0x1e2ee403300   COMPUTERNAME    DESKTOP-IT8QNRI1168    svchost.exe     0x20d91003300   COMPUTERNAME    DESKTOP-IT8QNRI1220    svchost.exe     0x15525003310   COMPUTERNAME    DESKTOP-IT8QNRI1256    svchost.exe     0x2459fa03380   COMPUTERNAME    DESKTOP-IT8QNRI1264    svchost.exe     0x19f93003380   COMPUTERNAME    DESKTOP-IT8QNRI1272    svchost.exe     0x1bdca403380   COMPUTERNAME    DESKTOP-IT8QNRI1392    svchost.exe     0x1d571403310   COMPUTERNAME    DESKTOP-IT8QNRI1404    svchost.exe     0x1f4e1203380   COMPUTERNAME    DESKTOP-IT8QNRI1412    svchost.exe     0x1e7b6803380   COMPUTERNAME    DESKTOP-IT8QNRI1540    svchost.exe     0x1a786803380   COMPUTERNAME    DESKTOP-IT8QNRI1564    svchost.exe     0x159ed203300   COMPUTERNAME    DESKTOP-IT8QNRI1612    svchost.exe     0x1870f203380   COMPUTERNAME    DESKTOP-IT8QNRI1656    svchost.exe     0x23f7f203380   COMPUTERNAME    DESKTOP-IT8QNRI1664    svchost.exe     0x26d73e03310   COMPUTERNAME    DESKTOP-IT8QNRI1692    svchost.exe     0x1a8ef003310   COMPUTERNAME    DESKTOP-IT8QNRI1924    svchost.exe     0x1cd20c03390   COMPUTERNAME    DESKTOP-IT8QNRI1936    svchost.exe     0x1a5aa203300   COMPUTERNAME    DESKTOP-IT8QNRI2040    svchost.exe     0x28734c03300   COMPUTERNAME    DESKTOP-IT8QNRI1092    svchost.exe     0x1cbca003380   COMPUTERNAME    DESKTOP-IT8QNRI1556    svchost.exe     0x1755a203300   COMPUTERNAME    DESKTOP-IT8QNRI2056    svchost.exe     0x1607a203380   COMPUTERNAME    DESKTOP-IT8QNRI2096    svchost.exe     0x1ddf3203390   COMPUTERNAME    DESKTOP-IT8QNRI2148    svchost.exe     0x202a7c03380   COMPUTERNAME    DESKTOP-IT8QNRI2200    svchost.exe     0x2d055803390   COMPUTERNAME    DESKTOP-IT8QNRI2208    svchost.exe     0x22240603380   COMPUTERNAME    DESKTOP-IT8QNRI2216    svchost.exe     0x1e894203380   COMPUTERNAME    DESKTOP-IT8QNRI2328    svchost.exe     0x20f1a403300   COMPUTERNAME    DESKTOP-IT8QNRI2372    svchost.exe     0x28f6a803300   COMPUTERNAME    DESKTOP-IT8QNRI2552    svchost.exe     0x1d550403380   COMPUTERNAME    DESKTOP-IT8QNRI2612    svchost.exe     0x14190003380   COMPUTERNAME    DESKTOP-IT8QNRI2808    svchost.exe     0x13773603380   COMPUTERNAME    DESKTOP-IT8QNRI2904    svchost.exe     0x24fd7603300   COMPUTERNAME    DESKTOP-IT8QNRI2912    svchost.exe     0x2bf76c03390   COMPUTERNAME    DESKTOP-IT8QNRI2920    svchost.exe     0x1fecc003390   COMPUTERNAME    DESKTOP-IT8QNRI2936    svchost.exe     0x222fd603300   COMPUTERNAME    DESKTOP-IT8QNRI2944    svchost.exe     0x1c6ff003380   COMPUTERNAME    DESKTOP-IT8QNRI2964    svchost.exe     0x2c83dc03300   COMPUTERNAME    DESKTOP-IT8QNRI3048    svchost.exe     0x2274ea03300   COMPUTERNAME    DESKTOP-IT8QNRI3060    svchost.exe     0x19ab5403300   COMPUTERNAME    DESKTOP-IT8QNRI2104    svchost.exe     0x28a0d603300   COMPUTERNAME    DESKTOP-IT8QNRI1620    MsMpEng.exe     0x1d550f71af0   COMPUTERNAME    DESKTOP-IT8QNRI3084    svchost.exe     0x26b1d003300   COMPUTERNAME    DESKTOP-IT8QNRI3112    svchost.exe     0x1e0fe203380   COMPUTERNAME    DESKTOP-IT8QNRI3444    svchost.exe     0x1ac18003300   COMPUTERNAME    DESKTOP-IT8QNRI4016    svchost.exe     0x212bba03380   COMPUTERNAME    DESKTOP-IT8QNRI4180    svchost.exe     0x14aa7203310   COMPUTERNAME    DESKTOP-IT8QNRI4224    svchost.exe     0x2bc54a03300   COMPUTERNAME    DESKTOP-IT8QNRI4412    sihost.exe      0x1c067791ba0   COMPUTERNAME    DESKTOP-IT8QNRI4444    svchost.exe     0x29ca26033c0   COMPUTERNAME    DESKTOP-IT8QNRI4472    svchost.exe     0x2102ac033c0   COMPUTERNAME    DESKTOP-IT8QNRI4916    svchost.exe     0x225e4203300   COMPUTERNAME    DESKTOP-IT8QNRI4944    ctfmon.exe      0x15a6f571ba0   COMPUTERNAME    DESKTOP-IT8QNRI5020    svchost.exe     0x2ad0e603380   COMPUTERNAME    DESKTOP-IT8QNRI4012    explorer.exe    0x5f1bd0        COMPUTERNAME    DESKTOP-IT8QNRI3996    svchost.exe     0x20aec403380   COMPUTERNAME    DESKTOP-IT8QNRI5152    svchost.exe     0x286c08033c0   COMPUTERNAME    DESKTOP-IT8QNRI5300    SearchIndexer.  0x1b74ee01af0   COMPUTERNAME    DESKTOP-IT8QNRI5564    StartMenuExper  0x13e33c03550   COMPUTERNAME    DESKTOP-IT8QNRI5664    RuntimeBroker.  0x227ed8033c0   COMPUTERNAME    DESKTOP-IT8QNRI5780    SearchApp.exe   0x26bb74034f0   COMPUTERNAME    DESKTOP-IT8QNRI6000    RuntimeBroker.  0x1cbeb4033c0   COMPUTERNAME    DESKTOP-IT8QNRI5200    YourPhone.exe   0x23f0e4034d0   COMPUTERNAME    DESKTOP-IT8QNRI6212    RuntimeBroker.  0x1b1968033c0   COMPUTERNAME    DESKTOP-IT8QNRI6340    svchost.exe     0x20510e03380   COMPUTERNAME    DESKTOP-IT8QNRI6752    RuntimeBroker.  0x240440033c0   COMPUTERNAME    DESKTOP-IT8QNRI6844    RuntimeBroker.  0x276c08033c0   COMPUTERNAME    DESKTOP-IT8QNRI6988    SecurityHealth  0x21a797e1c90   COMPUTERNAME    DESKTOP-IT8QNRI7024    SecurityHealth  0x22c36261af0   COMPUTERNAME    DESKTOP-IT8QNRI7132    svchost.exe     0x214cd003310   COMPUTERNAME    DESKTOP-IT8QNRI904     svchost.exe     0x293cc203300   COMPUTERNAME    DESKTOP-IT8QNRI5392    svchost.exe     0x1b733003300   COMPUTERNAME    DESKTOP-IT8QNRI7620    Spotify.exe     0x1c03410       COMPUTERNAME    DESKTOP-IT8QNRI7480    TextInputHost.  0x24f22e03500   COMPUTERNAME    DESKTOP-IT8QNRI3944    dllhost.exe     0x14d8a051ba0   COMPUTERNAME    DESKTOP-IT8QNRI8044    ApplicationFra  0x18d9aac1ba0   COMPUTERNAME    DESKTOP-IT8QNRI7584    svchost.exe     0x1af2da03390   COMPUTERNAME    DESKTOP-IT8QNRI8336    svchost.exe     0x27d7d603300   COMPUTERNAME    DESKTOP-IT8QNRI8584    svchost.exe     0x1f14e203300   COMPUTERNAME    DESKTOP-IT8QNRI8656    svchost.exe     0x20bc9e03380   COMPUTERNAME    DESKTOP-IT8QNRI8696    svchost.exe     0x277312033c0   COMPUTERNAME    DESKTOP-IT8QNRI1700    RuntimeBroker.  0x1d6ec4033c0   COMPUTERNAME    DESKTOP-IT8QNRI9692    svchost.exe     0x1e44aa03300   COMPUTERNAME    DESKTOP-IT8QNRI8020    UserOOBEBroker  0x26cec6c1ba0   COMPUTERNAME    DESKTOP-IT8QNRI9544    ShellExperienc  0x207b1403540   COMPUTERNAME    DESKTOP-IT8QNRI9452    RuntimeBroker.  0x1b6174033c0   COMPUTERNAME    DESKTOP-IT8QNRI1796    powershell.exe  0x2b90ca41c90   COMPUTERNAME    DESKTOP-IT8QNRI8592    conhost.exe     0x23b42571c90   COMPUTERNAME    DESKTOP-IT8QNRI1832    powershell_ise  0x26eddb71c90   COMPUTERNAME    DESKTOP-IT8QNRI9428    svchost.exe     0x1bc78803380   COMPUTERNAME    DESKTOP-IT8QNRI10648   svchost.exe     0x1b7fa203300   COMPUTERNAME    DESKTOP-IT8QNRI10992   conhost.exe     0x240d4f01d00   COMPUTERNAME    DESKTOP-IT8QNRI10284   powershell.exe  0x2192f471ba0   COMPUTERNAME    DESKTOP-IT8QNRI10268   conhost.exe     0x138ee371ba0   COMPUTERNAME    DESKTOP-IT8QNRI10840   svchost.exe     0x1cecbc03300   COMPUTERNAME    DESKTOP-IT8QNRI10500   SearchProtocol  0x254d0f21ba0   COMPUTERNAME    DESKTOP-IT8QNRI4064    svchost.exe     0x26845603300   COMPUTERNAME    DESKTOP-IT8QNRI10008   svchost.exe     0x1fbda203300   COMPUTERNAME    DESKTOP-IT8QNRI5948    svchost.exe     0x2ea60803300   COMPUTERNAME    DESKTOP-IT8QNRI8180    userinit.exe    0x1e1cc0        COMPUTERNAME    DESKTOP-IT8QNRI5864    SearchFilterHo  0x15cacf01ba0   COMPUTERNAME    DESKTOP-IT8QNRI3652    msedge.exe      0x1ef3dc03840   COMPUTERNAME    DESKTOP-IT8QNRI6032    msedge.exe      0x197e0803840   COMPUTERNAME    DESKTOP-IT8QNRI7008    msedge.exe      0x218c3203840   COMPUTERNAME    DESKTOP-IT8QNRI1628    msedge.exe      0x15061c03840   COMPUTERNAME    DESKTOP-IT8QNRI4924    msedge.exe      0x28138a03840   COMPUTERNAME    DESKTOP-IT8QNRI4248    smartscreen.ex  0x20e4c331ba0   COMPUTERNAME    DESKTOP-IT8QNRI32      msedge.exe      0x228b5c03840   COMPUTERNAME    DESKTOP-IT8QNRI2488    msedge.exe      0x184f4e03840   COMPUTERNAME    DESKTOP-IT8QNRI10808   msedge.exe      0x1e564803840   COMPUTERNAME    DESKTOP-IT8QNRI6540    msedge.exe      0x2436ca03840   COMPUTERNAME    DESKTOP-IT8QNRI420     msedge.exe      0x1c6e9803840   COMPUTERNAME    DESKTOP-IT8QNRI10432   notepad.exe     0x168a68a1c90   COMPUTERNAME    DESKTOP-IT8QNRI10748   Calculator.exe  0x267fcc03500   COMPUTERNAME    DESKTOP-IT8QNRI4156    RuntimeBroker.  0x12ffd6033c0   COMPUTERNAME    DESKTOP-IT8QNRI1996    msedge.exe      0x1f70ce03840   COMPUTERNAME    DESKTOP-IT8QNRI992     WWAHost.exe     0x1bb4e003500   COMPUTERNAME    DESKTOP-IT8QNRI5240    msedge.exe      0x24047a03840   COMPUTERNAME    DESKTOP-IT8QNRI5832    msedge.exe      0x20d4d203840   COMPUTERNAME    DESKTOP-IT8QNRI5860    winpmem_mini_x  0x1ef7b0e1c10   COMPUTERNAME    DESKTOP-IT8QNRI
```
Here we can clearly see the Computer Name:  `DESKTOP-IT8QNRI`
## flag{DESKTOP-IT8QNRI}